# Nmap OS Fingerprint List. -*- mode: fundamental; -*-
# $Id: nmap-os-fingerprints,v 1.119 2003/10/03 08:32:14 fyodor Exp $ 
#
# Contributions to this database are welcome.  If Nmap obtains a new
# fingerprint (and test conditions are favorable), it will print out a
# URL you can use to submit the fingerprint.  If Nmap guesses wrong,
# please send the full Nmap output and the exact destination host OS
# name and version to fyodor@insecure.org .  Thanks!
#
# By submitting fingerprints you are transfering any and all copyright
# interest in the data to Fyodor so that he can modify it, relicense it,
# incorporate it into programs, etc.
#
# This collection of fingerprint data is (C) 1998-2003 by
# Insecure.Com LLC.  This data is available for
# free use by open source software under the terms of the GNU General
# Public License.  We also license the data to selected
# commercial/proprietary vendors under less restrictive terms.
# Contact sales@insecure.com for more information.
#
# TEST DESCRIPTION:
# Tseq is the TCP sequenceability test
# T1 is a SYN packet with a bunch of TCP options to open port
# T2 is a NULL packet w/options to open port
# T3 is a SYN|FIN|URG|PSH packet w/options to open port
# T4 is an ACK to open port w/options
# T5 is a SYN to closed port w/options
# T6 is an ACK to closed port w/options
# T7 is a FIN|PSH|URG to a closed port w/options
# PU is a UDP packet to a closed port

Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0
Class 2Wire | embedded || WAP
TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Access Builder 4000 Switch
Class 3Com | embedded || switch
T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint 3Com terminal server ESPL CS2100
Class 3Com | embedded || terminal server
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com NBX Superstack 3 IP PBX running firmware 4_1_11
# 3com NBX-100 (version R4_1_4) Phone System Processor
Fingerprint 3Com NBX PBX
Class 3Com | embedded || PBX
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint 3com Office Connect Router 810
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<186A4%SI=<14)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint 3Com OfficeConnect Remote 812 ADSL Router
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<C354%SI=<1E)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Switch 1100, 3300
Fingerprint 3Com SuperStack II switch (OS v 2.0)
Class 3Com | embedded || switch
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38
Class 3Com | embedded || switch
TSeq(Class=TD%gcd=<68%SI=<3C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

# 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Fingerprint 3Com Netbuilder Remote Office 222 router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
Class 3Com | embedded || router
TSeq(Class=TD%gcd=3C%SI=<FF)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

# 3COM Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604
Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint 4.3BSD-tahoe on a MicroVax III
Class DEC | BSD-misc || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# DELL PowerVault 132T Library (Firmware 103D.GY001)
Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
Class ACC | embedded || router
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7
Class Alteon | embedded || load balancer
TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16
Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16
Class Actiontec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=1194%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Avaya G3 PBX version 8.3
Class Avaya | embedded || PBX
TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022
Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway
Class Avaya | embedded || telecom-misc
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SMC Barricade Wireless Broadband Router (firmware R1.93e)
# D-LINK DL-707 Cable/DSL Router
Fingerprint SMC Barricade or D-Link DL-707 Wireless Broadband Router
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e)
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# SMC Barricade7004VBR Boot Code v1.05
# SMC 7004VBR broadband router - firmware v1.2
# SMC Wireless AP 7004WFW
# SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router
Fingerprint SMC Barricade DSL Router/Modem/Wireless AP
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SMC Barricade Router, firmware 1.94a
Class SMC | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 350 Access Point, software rev 12.02T1
# Accelerated Networks VoDSL - But what sort of device?
Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 360 Access Point
Class SonicWall | embedded || firewall
Class Enterasys | embedded || switch
Class Cisco | embedded || WAP
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07)
Class Acorn | Risc OS || general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd)
Class Acorn | Risc OS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# AGE Logic, Inc. IBM X-Station
Fingerprint AGE Logic, Inc. IBM XStation
Class IBM | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
Class Aironet | embedded || bridge
TSeq(Class=C%Val=0)
T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps wireless access point
Class Aironet | embedded || WAP
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet Wireless Bridge running firmware V5.0J
Class Aironet | embedded || bridge
TSeq(Class=C|TR)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2 running on RS/6000
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.3 running on RS6000 model 560
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.5 (Bull HardWare)
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.0 - 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.02.0001.0000
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1-4.1.5
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.1 running on a C10
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2-4.3.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2.X-4.3.3.0
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=U)
T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 4.3.3 on an RS/6000 H50
# Fingerprint IBM AIX 4.3.3 on a p660-6M1
# IBM AIX 4.3.3 ML10
Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM 8239 Token-Ring Stackable Hub
Class IBM | embedded || hub
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R2M0
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R5M0
Class IBM | OS/400 | V4 | general purpose
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM proprietary operating system for AS/400 systems (now known as "iSeries")
Fingerprint IBM OS/400 V5R1M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I)
T1(DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V5R2M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I)
T1(DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java
Fingerprint IBM OS/400 V5R1M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint IBM-RS/6000 7017-S80 AIX-Version 4.3.3.0
Fingerprint IBM AIX 4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX Version 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1 on a p610-6C1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 5.1.0.0 maintenance level 3
Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Alcatel 1000 ADSL (modem)
Class Alcatel | embedded || broadband router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel 1000 DSL Router
Class Alcatel | embedded || broadband router
TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Alcatel Advanced Reflexes IP Phone, Version: E/AT400/46.8
Class Alcatel | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Alcatel OmniStack switch version 4.3.3 GA
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Alcaltel Speed Touch Home running GV8BAA3.235 (992640)
# Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
#  Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
Fingerprint Alcatel Speed Touch *DSL modem/router
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)

# Alcaltel Speed Touch 510 *DSL router (uses THOMSON Unix embeded Version 4.0.0.9.0)
Fingerprint Alcatel Speed Touch 510 *DSL modem/router
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
Class Allied Telesyn | embedded || hub
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
Class Allied Telesyn | embedded || switch
TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
# Ericsson Home internet Solution ver. 2.0
Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
Class Allied Telesyn | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Alteon AceSwitch 110 (software 4.0.37)
# Centillion C100 ATM Switch OS Version 2.0.2.
Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch
Class Alteon | embedded || switch
Class Cantillion | embedded || switch
TSeq(Class=TD%gcd=<9C8%SI=<1E)
T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Alteon ACEswitch 184 Software Version 8.0.49
Fingerprint Alteon ACEswitch 184 V. 8.0.49
Class Alteon | embedded || switch
TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 2.1-3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.1-3.2
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP 4.3
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Amos 2.3A
Class Alpha Micro | AMOS || general purpose
TSeq(Class=i800%gcd=<6%SI=<14)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AOS/VS on a Data General mainframe
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=32|64|96%SI=1)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Apollo Domain/OS SR10.4
Class Apollo | Domain/OS || general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<FF)
T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint AOS/VS or VSII
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=40|80|C0%SI=0)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint APC MasterSwitch Network Power Controller
Class APC | embedded || power-device
TSeq(Class=TR)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint APC Web/SNMP UPS management card
Class APC | embedded || power-device
TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Smart-UPS 3000RM Firmware: 92.14.I
Fingerprint APC Smart-UPS 3000RM
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<138C%SI=<DC%IPID=I)
T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ARESCOM NetDSL 1000NDS series ADSL router
Class ARESCOM | embedded || broadband router
TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint ARLAN BR2000E V5.0E Radio Bridge
Class Arlan | embedded || bridge
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router
Class Ascend | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U)
T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend P130 Router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ascend Max 1800 50Ap8+ or 2024 router
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS
Fingerprint Ascend / Lucent MAX TNT Running TAOS version 8.0.1 w/ VoIP Hash
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>1000)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 running 5.1A Firmware
Class Ascend | embedded || router
TSeq(Class=64K)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 rev 4.6C
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710%SI=<5)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
Class Ascend | Embedded/OS || router
TSeq(Class=RI%gcd=<5%SI=>600)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Ascend P75 router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline P130 or 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend TNT OS +5.0Ap48+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Airport Extreme Base Station (WAP)
Class Apple | embedded || WAP
TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# on Macintosh GS server
Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# MacOS 8.6 running WebStar http server
Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

#  Mac OS 9 on a Power Macintosh 7200/75
# iMac running Mac OS 9.1
Fingerprint Apple Mac OS 9 - 9.1
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0?
Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4)
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(W=2000%ACK=O%Flags=R%Ops=)
T5(W=0%ACK=S++%Flags=AR%Ops=)
T6(W=0%ACK=O%Flags=R%Ops=)
T7(W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS X 1.1-1.2
Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1 - 10.1.4
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.5
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Mac OS 10.2.6, darwin kernel 6.6
Fingerprint Apple Mac OS X 10.1.5-10.2.6
Class Apple | Mac OS X | 10.1.X | general purpose
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.6 (Jaguar)
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1
Class Apple | Newton OS || PDA
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=R%Ops=)
PU(Resp=N)

# Actually it is not constant seq class -- it just seems that way
# because it takes so long to increment
Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
Class Apple | embedded || printer
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# The sequence prediction is never really true random, but sometimes it
# has two unique "tracks" which make it look random to nmap.  Here is a
# real example:  Sequence numbers: 5576001 25D001 5576001 25D001
Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
Class Apple | embedded || printer
TSeq(Class=TR|C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Asante 6524-2G GigE switch
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
Class Asante | embedded || switch
TSeq(Class=C%Val=4090000)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraSwitch 5324
Class Asante | embedded || switch
TSeq(Class=C%Val=80000)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch)
Fingerprint Asante IntraSwitch 6216M firmware v2.05A
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AsanteHub 2072 Ethernet Hu
Class Asante | embedded || hub
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
Class Asante | embedded || hub
TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
Class Auspex | AuspexOS || fileserver
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Atari Mega STE running JIS-68k 3.0
Class Atari | Atari || general purpose
TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AtheOS ( www.atheos.cx )
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<8%SI=<A78&>6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AtheOS/Syllable 0.4.2
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint ATT Unix SVR4.2 on a Lucent Definity voicemail system
Class Lucent | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2
Class Apple | A/UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Axent Raptor Firewall running on Windows NT
Class Axent | Windows | NT/2K/XP | firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

# Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Fingerprint AXIS or Meridian Data Network CD-ROM server
Class AXIS | embedded || fileserver
TSeq(Class=C)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS 540/542 print server v5.30 Jan 24 1997
Fingerprint AXIS 540/542 print server v5.30
Class AXIS | embedded || print server
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axis 540 e'net print server ver 5.48
Class AXIS | embedded || print server
TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axis 540 print server
Class AXIS | embedded || print server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axis 2120 network camera
Class AXIS | embedded || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AXIS NetEye Camera Server V1.20
Class AXIS | embedded || webcam
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS NetEye Camera Server V1.20
# Axis NPS 53X Printer Server V4.26 Jul 01 1995
# AXIS StorPoint CD-Rom server V 4.20
# AXIS Camera 200pV1.41
Fingerprint AXIS Stack -- CD-ROM Server or Print Server or Camera Server
Class AXIS | embedded || fileserver
Class AXIS | embedded || print server
Class AXIS | embedded || webcam
TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axis 200+ Web Camera running OS v1.42
Class AXIS | embedded || webcam
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

# The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uC-Linux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/.
Fingerprint Axis 2100 Network Camera running Linux/CRIS v2.32
Class AXIS | Linux || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# AXIS 540+/542+
# AXIS 5400 print server
Fingerprint AXIS Network Print Server
Class AXIS | Linux || print server
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
# Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
Class Bay Networks | embedded || router
T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bay Networks BayStack 310T switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BayStack 28115/ADV Fast Ethernet Switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Baystack Instant Internet 400 SoHo Router
Class Bay Networks | embedded || router
TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Running on a BeBox 66Mhz
Fingerprint BeOS 4 - 4.5
Class Be | BeOS | 4.X | general purpose
TSeq(Class=TD%gcd=1%SI=0)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS R5.03 Personal Edition
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a)
Class Be | BeOS | 5.X | general purpose
TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.1d0/DANO on x86
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# F5 labs BigIp Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
# F5 BIG-IP 540 loadbalancer.
Fingerprint F5 Labs BigIp Load balancer Kernel 4.1.1PTF-03 (X86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint F5 Labs Big-IP load balancer kernel 4.2PTF-05a (X86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP)
Class FiberLine | embedded || WAP
TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# XS SW Release 4.9.1 ISDN access router
# Bintec BIANCA XM OS-Version 4.93
Fingerprint Bintec XS/XM ISDN access router V. 4.9.1-4.9.3
Class Bintec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Borderware 5.0 Firewall
Class Borderware | embedded || firewall
TSeq(Class=TR|RI%gcd=<204%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Borderware 5.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=N)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Borderware 6.0.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# http://www.brixnetworks.com/products/brix1000.html
Fingerprint Brix 1000 Verifier
Class Brix Networks | embedded || specialized
TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 2.0 - 2.1
Class BSDI | BSD/OS | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
Class BSDI | BSD/OS | 3.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0-4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# (rel. ID: 17908)
Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheOS (CacheFlow 2000 proxy cache)
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>1111)
T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon GP 160 PF printer
Class Canon | embedded || printer
TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Canon IR6000 printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon photocopier/fax/scanner/printer GP30F
Class Canon | embedded || printer
TSeq(Class=TD%gcd=600%SI=0)
T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Capellix 3000 Modular SAN Switch
Class Capellix | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Chase IOLan Terminal Server
Class Chase | embedded || terminal server
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=TD%gcd=<8%SI=<154)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3
Fingerprint Checkpoint SecurePlatform NG FP3
Class Checkpoint | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8)
Class Cisco | IOS | 12.X | WAP
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AIR-WGB340 V8.38 Workgroup Bridge 340
Fingerprint Cisco AIR-WGB340 V8.38 wireless workgroup bridge 340
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco WGB350 802.11b WorkGroup Bridge
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 766 non-IOS software 4.2(3.5)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=82000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem
Class RCA | embedded || broadband router
Class Cisco | embedded || hub
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 2620 router running IOS 12.1(6)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 3600 router running IOS 12.2(6c)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set
# CISCO 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
Fingerprint Cisco 801/1720 router running IOS 12.2.8
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 827 aDSL router running IOS 112.2(11)
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Found on Cisco 1720/1750/2611/3640/AS5300 routers
Fingerprint Cisco router running IOS 12.1.5-12.2.13a
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1601R router running IOS 12.1(5)
Class Cisco | IOS | 12.X | router
TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 4500 router running IOS 11.2(2)
Class Cisco | IOS | 11.X | router
T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 7206 running IOS 11.1(24)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Cache Engine Web Proxy
Class Cisco | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco CPA2500 (68030) or 2511 router
Class Cisco | IOS || router
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
# Cisco Catalyst 5500 with OS Version 6.3(5)
# Alcatel Omni Switch/Router! Version 4.3.1 GA
Fingerprint Cisco Catalyst 5500/6500 or Alcatel Omni Switch/Router
Class Cisco | embedded || switch
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco AS5200 terminal server
Class Cisco | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2)
Class Cisco | NmpSW || switch
SInfo(V=3.00%P=i686-pc-linux-gnu%D=2/12%Time=3E4A758F%O=23%C=1)
TSeq(Class=TR%IPID=I%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# The "True Random" is bogus, it is because of sequences
# from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
Fingerprint Cisco Localdirector 430, running OS 2.1
Class Cisco | embedded || load balancer
TSeq(Class=TR|C)
T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco PIX 4.2(2) Internal Interface
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall running PIX 4.1(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C%Val=211E005F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX v4.2 Firewall
Class Cisco | PIX | 4.X | firewall
TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 firewall running software 4.4(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 506 Firewall
Class Cisco | PIX || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.1(2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 or 525 running 6.1(4) - 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle
# PIX 506 running PIX IOS 6.2
Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
Class Cisco | PIX | 5.X | firewall
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco PIX running IOS 6.1(1) - Internal interface
Fingerprint Cisco PIX w/IOS 6.1(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 501 firewall running PIX 6.1(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%IPID=I%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX]
# Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 2501, 4500
Fingerprint Cisco 2501/4500 router with IOS Version 10.3(15) - 11.1(20)
Class Cisco | IOS | 10.X | router
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=<6%SI=<2000)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IP phone (POS3-04-3-00, PC030301)
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
Class Cisco | IOS | 11.X | terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 5200 router running IOS v12.0(15)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=1%SI=<FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch,  or Netopia DSL/ISDN router
Class Cisco | embedded || switch
Class Bay Networks | embedded || switch
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<6000%SI=<1E)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2820 switch Management Console
Class Cisco | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

Fingerprint Cisco IOS 11.3 - 12.0(11)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<6)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1700 running IOS 12.0(7)T
Fingerprint IOS 12.0(7)T (on a 1700 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.0(21) (On a 2514 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco IOS 12.0(16a) Service Provider feature set
# Cisco WS-C3508G-XL running 12.0(5)WC3
Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1)
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 7206 router (IOS 11.1(17)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=>666)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=<11170)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Local Director 420 version 2.1.1
Class Cisco | embedded || load balancer
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<4%SI=<999&>CC)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 25XX/45XX router, 29XX switch, RSP2 processor
Fingerprint Cisco Router/Switch with IOS 11.2
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# A Cisco ATA 186 is a little box that allows a standard POTS
# telephone to be used as a voice-over-Ip phone.  There is a
# variation, the ATA 188 that has a pass-through port, much like the
# Cisco 7960 phone.
Fingerprint Cisco ATA 186 POTS<->VOIP phone gateway device
Class Cisco | embedded || telecom-misc
TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Cisco 675 DSL router -- cbos 2.1
Class Cisco | CBOS || broadband router
T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub
Class Cisco | embedded || broadband router
Class IBM | embedded || hub
TSeq(Class=TD|i800%gcd=<14004%SI=<14)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco ATA-186 or 7905 VoIP Phone
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CacheOS (1.1.0)
Class Cisco | CacheOS || web proxy
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco Content Engine 505 Software V. 4.2.1
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# running Application and Content Networking System Software 4.2.3
# Fingerprint Cisco Content Engine 560 Software V. 4.2.3
Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco uBR 7223 router
Class Cisco | IOS || router
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3COM 4924 gigabit switch ver 2.04
# Cisco VPN 3000 3.5
Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch
Class Cisco | embedded || encryption accelerator
Class 3Com | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 3000 Series VPN Concentrator
Class Cisco | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
Class Cisco | embedded || router
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=<416%SI=<1E)
T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11
Class Cnet | embedded || broadband router
TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2
Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2
Class CNT | embedded || storage-misc
TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
Class Cobalt | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# corega BAR SW-4P  [Part number:CG-BARSW4P]
Fingerprint Corega BAR SW-4P Broadband Access Router
Class Corega | embedded || broadband router
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
Class Commodore | embedded || game console
TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Commodore 64 with TFE Ethernet Card (Contiki)
Class Commodore | embedded || game console
TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
# firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
# applies to firmare 4.2 on RISC routers, but I have not checked.
Fingerprint Compatible Systems (RISC Router, IntraPort)
Class Compatible Systems | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<6)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d
Class Computone | embedded || terminal server
TSeq(Class=TD%gcd=40%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control
Class Livingston | ComOS || terminal server
Class 3Com | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
Class Lucent | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Convex OS Release 10.1
Class Convex | ConvexOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cray UNICOS/mk 8.6
Class Cray | UNICOS | 8.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint UNICOS 10.0.0 on Cray 90
Class Cray | UNICOS | 10.X | general purpose
TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6%SI=>F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cyberguard 4.0 firewall
Class Cyberguard | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Cyclades PathRouter V 1.2.4
Class Cyclades | Cyros || router
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
Class Cyclades | Cyros || terminal server
TSeq(Class=TD%gcd=30C382%SI=<BB)
T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.7
Class Cyclades | Cyras || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter
Class Cyclades | Cyras || router
TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter/PC
Class Cyclades | Cyras || router
TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
Class Datavoice | embedded || CSUDSU
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# DECbrouter90T1 Runs Cisco IOS 10.2(5)
# Cisco 1601, IOS 11.0
Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
Class Cisco | IOS | 11.X | router
Class DEC | IOS | 10.X | router
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 12008 running IOS 12.0(18.6)S1
# Cisco 7206VXR running IOS 12.0(18)S
Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.1(4) on a 2600 router
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 3620 running IOS 12.2.1
# IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
Fingerprint Cisco router running IOS 12.1(5)-12.2(7a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 2621 running IOS 12.2.8T
# Cisco SOHO 77 running IOS 12.2(8)T
Fingerprint Cisco router running IOS 12.2(8)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 7507 running 12.2(8)T5
Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router
Class DEC | embedded || router
TSeq(Class=TD%gcd=30D4|C35%SI=<F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# DECserver 700-16, Network Access SW V2.2
Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2
Class DEC | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack
Class DEC | VMS || general purpose
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VMS MultiNet V4.1(16)
Class DEC | VMS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.1
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP
Class DEC | OpenVMS | 6.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=i800|64K)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2/Alpha
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U)
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Digital TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3
Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC OpenVMS 7.1 Alpha running Digital's UCX v4.1ECO2 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V7.1 on VAX 6000-530
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1
Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U)
T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=)
T4(DF=N%W=C350%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3-1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DEC VAXVMS TCPIP V5.1-15  Full LP Installed
Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenVMS 7.3 with TCP/IP 5.3
Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3)
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital Networks VNswitch 900
Class Digital Networks | embedded || switch
TSeq(Class=TD%gcd=<4%SI=<4)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3000
Class Digitel | embedded || router
TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3100
Class Digitel | embedded || router
TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.11MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=<20004%SI=<1E)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# dgux DataGeneral_Server R4.20MU04 generic AViiON PentiumPro
Fingerprint Data General DG/UX Release R4.20MU04
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<32CBC&>281)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU06
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor
Class Digital Link | embedded || CSUDSU
TSeq(Class=TD%gcd=<2780%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C
Class DEC | Digital UNIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F
Class DEC | Digital UNIX | 4.X | general purpose
TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Draytek Vigor 2000 ISDN router
Class Draytek | embedded || broadband router
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Draytek Vigor 2200e DSL router v2.1b
Class Draytek | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# 
Fingerprint Draytek Vigor 2200e DSL Router v2.1a
Class Draytek | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Integrated Lights Out remote configuration Board
Class Compaq | embedded || specialized
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Proliant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002
Fingerprint Compaq Proliant DL580 Integrated Lights-Out remote configuration board V1.06
Class Compaq | embedded || specialized
TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
T1(DF=N%W=400%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00
# NetGear MR814 WAP
Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814
Class Compaq | embedded || WAP
Class Netgear | embedded || WAP
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Compaq Tru64 UNIX (formerly Digital UNIX) 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=C)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Compaq Tru64 UNIX 5.0 on AlphaServer
# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2
Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2
Class Compaq | Tru64 UNIX | 5.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030)
Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K 
Class Quanterra | OS/9 || specialized
TSeq(Class=i800)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=C000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/Digital Tru64 Unix)
TSeq(Class=RI%gcd=<6%SI=<E88&>11)
Class Compaq | Tru64 UNIX | 5.X | general purpose
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF/1 V1.3A - 2.0
Class DEC | Digital UNIX | 1.X | general purpose
Class DEC | Digital UNIX | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF1 (AKA Compaq/Digital Tru64 UNIX) Version 5.0.0
Class DEC | Digital UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint OSF/1 (AKA Compaq/Digital Tru64 UNIX) 5.60
Class DEC | Digital UNIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F
Class DEC | Digital UNIX | 4.X | general purpose
TSeq(Class=C|RI%gcd=<6)
T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint Sequent DYNIX/ptx 4.0 V4.4.6 i386
Class Sequent | DYNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Sequent Dynix/PTX 4.4.2
Class Sequent | DYNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<15E0&>23)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Software version VIK-1.35.020320j -- www.easytel.fi
Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
Class Easytel | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Edimax BR-6004 broadband router
Class Edimax | embedded || broadband router
TSeq(Class=i800%IPID=I%TS=2HZ)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12
Class Edimax | embedded || print server
TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware
Class Eicon | embedded || broadband router
TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/10 Office 2.62.0002
Fingerprint ELSA LANCOM DSL/10 Office router v2.62.0002
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/
# ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001
Fingerprint ELSA LANCOM DSL/I-1611 Office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1
Class EMC | DART || fileserver
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint EMC IP4700 Filer
Class EMC | DART || fileserver
TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Enterasys XP-2400 switch running Enterasys E9.0.0.0
# Cabletron Smartswitch 6000 running Enterasys E8.2.0.0
Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0
Class Enterasys | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
Class Epson | embedded || printer
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
Class Epson | embedded || printer
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ericsson HM220dp ADSL modem/router
Class Ericsson | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Exabyte X80 tape backup robot
Class Exabyte | embedded || storage-misc
TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1
Class Extreme Networks | Extremeware || switch
TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Networks Black Diamond switch
Class Extreme Networks | embedded || switch
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Gigabit switch (unknown version)
Class Extreme Networks | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint NAT LANB/290 router Console Program V4.00
Class NAT | embedded || router
TSeq(Class=TD%gcd=<80004%SI=<14)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3
Class NCR | BSD-misc || general purpose
TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38)
T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System
Class NCR | BSD-misc || general purpose
TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
Class F5 Labs | BSDI || load balancer
TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i)
Class Netopia | embedded || broadband router
Class Compatible Systems | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A
Class FastComm | embedded || specialized
TSeq(Class=TD|RI%gcd=<8%SI=<1E)
T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Fore ForeThought 7.1.0 ATM switch
Class Fore | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Foundry 1500 OS Ver 7.2.06T51
# Foundry ServerIron XL 16 Port 7.3.06T12
Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Foundry FastIron Edge Switch (load balancer) 2402
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
Class Galacticomm | WorldGroup || BBS
TSeq(Class=C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP
Class Galacticomm | WorldGroup || BBS
TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Gandalf LanLine Router
Class Gandalf | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Genius print server
Class Genius | embedded || print server
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface)
Class Global Technology Associates | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<F708&>264)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
Class Gauntlet | Solaris | 2.5.X | firewall
TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

# GNet BB0040 DSL router
# SAR-703 Combined ADSL Modem/Router
Fingerprint GNet BB0040 or SAR 703 DSL modem + router
Class GNet | embedded || broadband router
Class SAR | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<14)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
Class FlowPoint | embedded || broadband router
Class ASCOM | embedded || broadband router
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Flowpoint 144 or 22XX DSL Router v3.0.8
# SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
Fingerprint DSL Router: Flowpoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
Class FlowPoint | embedded || broadband router
Class SpeedStream | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)

# speedstream router 5871 v4.0.1
Fingerprint Speedstream 5871 DSL router
Class SpeedStream | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1 - 4.1
Class FreeBSD | FreeBSD | 2.X | general purpose
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
T4(DF=N%W=4000|0|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.1.0 - 2.1.5
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1-STABLE
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 3.2-4.0
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint FreeBSD 3.4-RELEASE
Class FreeBSD | FreeBSD | 3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.0-20000208-CURRENT
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.1.1 - 4.3 (X86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
Fingerprint FreeBSD 4.4-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.4 for i386 (IA-32)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.5-RELEASE (or -STABLE) (X86
# FreeBSD 4.6-RC
Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (X86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6-RC on Alpha
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# 4.6-RELEASE
# 4.6-STABLE
# 4.6.2-RELEASE-p6
Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (X86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6.2-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.7-RELEASE (X86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-RELEASE
# 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002
Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386
Fingerprint FreeBSD 4.7-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD-4.7-RELEASE-p3 on i386
Fingerprint FreeBSD-4.7-RELEASE-p3
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-STABLE (Jan 2003)
Fingerprint FreeBSD 4.7-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.7-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ)
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

#  FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
Fingerprint FreeBSD 5.0-CURRENT (Apr 2002)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386
# FreeBSD 5.0-RELEASE Alpha
Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE (x86)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) X86
Class GNU | Hurd || general purpose
TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Hitachi HI-UX/MPP
Class Hitachi | HI-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# HP Router 210 with OS 9.72
# Netgear RP114 DSL-Router with 4-Port Switch
Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch
Class HP | embedded || switch
Class Netgear | embedded || broadband router
TSeq(Class=TD%SI=<20)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Don't ask me what this is :)  David says
# it is "a Utah port of BSD to HP machines"
Fingerprint HP-BSD 2.0
Class HP | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP Deskjet 6127 printer
Class HP | embedded || printer 
TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP Entria X station (running Netstation 7.x)
Class HP | Netstation || X terminal
TSeq(Class=64K)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP j4813A ProCurve Switch 2524
# Copper Mountain Networks DSL Concentrator
# Compaq Remote Insight Lights-Out remote console card
# 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14
# TrueTime NTS-200 GPS Network Time Server
# Compaq Lights Out Edition firmware v2.41
# 3Com NBX 25 (Phone System) Version: R1_0_3
Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock
Class Copper Mountain | embedded || terminal server
Class 3Com | embedded || WAP
Class 3Com | embedded || telecom-misc
Class TrueTime | embedded || specialized
Class Compaq | embedded || specialized
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP JetDirect printer/rint server
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
Class HP | embedded || print server
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP printer w/JetDirect card (Firmware Rev. H.06.00)
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<8%SI=<14)
T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer
# JetDirect 610n (Model J4169A) firmware L.24.06
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
# HP LaserJet 2200 with JetDirect (J6057A)
Fingerprint HP JetDirect Card in a LaserJet printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# 2100 Series, 4000 TN, 4000 PS, 8000 DN
Fingerprint HP LaserJet printer/print server
Class HP | embedded || printer
Class HP | embedded || print server
TSeq(Class=TD%gcd=<6%SI=<100)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4000N Printer
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4100N printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP pritner w/JetDirect J2556b card Firmware A.05.32
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# This is a HP 5si printer with a Jetdirect Ethernet card model# J2556b Firmware A.05.32
Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32)
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Jet Direct Model J3113A, Firmware Rev G.07.20
# HP Color LaserJet 4500N, Jet Direct J3113A/2100
Fingerprint HP Printer w/Jet Direct
Class HP | embedded || printer
T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP LaserJet 5
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP Procurve Routing Switch 9304M
Class HP | embedded || load balancer
TSeq(Class=C)
T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 9.01 - 9.07
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# XXX: It crashed the machine again, but I got a full
# scan this time.
Fingerprint HP-UX B.10.01 A 9000/715
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K|TR)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 A 9000/750
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX release B.10.20 version A
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 9000/897
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# This is a wierd one
Fingerprint HP-UX 11.00
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TD%gcd=>20000%SI=<3)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B11.00 U 9000/839
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
T1(Resp=N)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/800
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/785
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP9000 Model 804 K450 running HP/UX 11.00
# Mac OS9
Fingerprint Mac OS 9, or HP/UX 11.00
Class HP | HP-UX | 11.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP MPE/iX 5.5
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<14)
T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP MPE/iX 5.5 on HP 3000
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1)
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Hua Wei Quidway Router R2621E VRP 1.5.6
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Hydra HydraWEB 5000
Class Hydra | embedded || load balancer
TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM 2210 router
Class IBM | embedded || router
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks
Class IBM | embedded || router
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 8222 hub
Class IBM | embedded || hub
TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
Class IBM | embedded || router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 3494 Magnetic Tape Library
Class IBM | embedded || storage-misc
TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# IBM AIX v3.2.5 running on 8xPower-2 wide nodes
# Fingerprint AIX Version 4
Fingerprint IBM AIX v3.2.5 - 4
Class IBM | AIX | 3.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5L 5.1
# IBM AIX 5.1 ML00
Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1-5.2 on RS/6000
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM Infoprint 12 Net-Printer
Class IBM | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
Class IBM | embedded || switch
Class Xylan | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V 2.1
Class IBM | OS/2 || general purpose
TSeq(Class=64K)
T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V.3
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp 4.0
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AS/400 running OS/400 R4.4
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AS400 running OS/400 5.1
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# added by Beat Rubischon <beat@rubis.ch>
Fingerprint IBM AS/400 V3 and V4
Class IBM | OS/400 | V3 | general purpose
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM VM/CMS (mainframe)
Class IBM | VM/CMS || general purpose
TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
Class IBM | VM/CMS || general purpose
TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# D-LINK DI-713P wireless router (firmware 2.60 build 6a)
# 704P Ethernet Broadband Gateway
Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP
Class D-Link | embedded || broadband router
TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U)
T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DLink DI-604 ethernet router using firmware 1.62 build 2
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DLink DI-604 ethernet router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled
# Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
# boot PROM version 2.21)
Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
Class D-Link | embedded || hub
TSeq(Class=TD%gcd=1388%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-701, Version 2.22
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a)
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DLink DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7)
Fingerprint DLink DI-804 Cable/DSL Residential Gateway (firmware v2.00B7)
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<10%SI=<3C%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DCS-1000 webcam with firmware 1.06
Class D-Link | embedded || webcam
TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# D-Link DSL-300G+ version 7.1.0.30 ANNEXA  (Oct 18 2002) R2.05.b4t9uk
Fingerprint D-Link DSL-300G+ DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint D-Link DSL-500 DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link Print Server
Class D-Link | embedded || print server
TSeq(Class=TD%gcd=<72%SI=<1E)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=N)
T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint D-Link DWL-5000AP WAP/BSP 1.3
Class D-Link | embedded || WAP
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28
# 3com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2)
Fingerprint wireless access point (WAP): D-Link DRC-1000AP or 3com Access Point 2000
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Intel Corporation, ER9100 Express Router 9100
# Fingerprint by Ron van Daal (ronvdaal@syntonic.net)
Fingerprint Intel Corporation, ER9100 Express Router 9100
Class Intel | embedded || router
TSeq(Class=TD%gcd=10|20|30%SI=1)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel Express 510T switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=10|20|30%SI=<BB)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel InBusiness Print Station
Class Intel | embedded || print server
TSeq(Class=64K)
T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress 10 3-port print server
Class Intel | embedded || print server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel Netport Express PRO print server V04.33a
Class Intel | embedded || print server
TSeq(Class=TD%gcd=1%SI=0)
T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
Fingerprint Intel NetportExpress 10/100 3-port print server
Class Intel | embedded || print server
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress XL print server
Class Intel | embedded || print server
TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Intel NetStructure 470T Switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Labtam MT300, X-Terminal Kernel
Class Labtam | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<404C&>90)
T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS1 print server version V3.5/1(970325)
Class Lantronix | embedded || print server
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS2 print server Version V3.5/2(970721)
Class Lantronix | embedded || print server
TSeq(Class=RI|TD%gcd=<6)
T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint LG Goldstream LR3001f router, software version 4.0
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Microbase VirtuOS v3.00b R.09
Class Microbase | VirtuOS || general purpose
TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MultiTech CommPlete Controller (terminal server)
Class MultiTech | embedded || terminal server
TSeq(Class=TR|RI%gcd=<6%SI=>FFFF)
T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint MultiTech MultiVOIP Version 2.01A Firmware
Class MultiTech | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MultiTech standalone firewall box, version 3
Class MultiTech | embedded || firewall
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)

Fingerprint IBM MVS TCP/IP TCPMVS 3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint IBM MVS TCP/IP TCPOE 3.3
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=<6%SI=<BB0)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=64|C8|12C|190)
T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192
# Innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096
Fingerprint Innovaphone IP200/IP400 VOIP phone/gateway
Class Innovaphone | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Bay Networks Instant Internet router
Class Bay Networks | embedded || router
TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# IPAD Model 5000 (see www.ipad-canada.com)
# esoft IPAD, v.1.52 -- 64 line option on i86 hardware
Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52 
Class NetMatrix | embedded || general purpose
TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444)
T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 5.2
Class SGI | IRIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 5.3
Class SGI | IRIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2 - 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0)
T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.2 - 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=i800)
T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.4 - 6.5.3m  # Lamont Granquist (again :)
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI%gcd=10%SI=<2222)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5 Origin2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IP19/IP27/IP30/IP32
Fingerprint SGI IRIX 6.5-6.5.15m
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ)
T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SGI IRIX 6.5.7f-6.5.8f
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SGI IRIX 6.5.15m on SGI O2
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# SGI O2 running SGI IRIX 6.5.7f
Fingerprint SGI IRIX 6.5.7f-6.5.8f
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# SGI IRIX 6.5.14, SGI O2
# SGI IRIX 6.5 IP32
Fingerprint SGI IRIX 6.5.14
Class SGI | IRIX | 6.X | general purpose
TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ)
T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Isolation Systems Infocrypt Enterprise
Class Isolation | embedded || encryption accelerator
TSeq(Class=C)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server
Class Ixia | embedded || specialized
TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Juniper Router running JUNOS
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<5%SI=>FFF)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Juniper Networks JUNOS 5.5R1.2 built 2002-09-28
Fingerprint Juniper Networks router JUNOS 5.5R1.2
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box.
Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on X86 box
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# KA9Q is a networking OS used mostly by amateur radio operators for radio to
# internet gateways.
Fingerprint KA9Q amateur radio OS
Class KA9Q | KA9Q || specialized
TSeq(Class=TD%gcd=37000%SI=<1E)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3com OfficeConnect 812 ADSL router firmware 2.0.0
# Kentrox Datasmart 656 CSU/DSU or USR Netserver/16
Fingerprint Kentrox Datasmart 656 CSU/DSU, USR Netserver/16, or 3Com OfficeConnect ADSL router
Class Kentrox | embedded || CSUDSU
Class US Robotics | embedded || switch
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Kronos Time clock
Class Kronos | embedded || specialized
TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Kyocera IB-21 Printer NIC
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Lantronix LSB4 Ethernet Switch
Class Lantronix | embedded || switch
TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint RoadLanner broadband router BRL-04FW 6.15.02r Build 0091 L:01
Class RoadLanner | embedded || broadband router
TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2
Class Rockwell | embedded || telecom-misc
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
# Trancell Webramp router or Xylan Omni Switch 3.2.X.X - 3.4.X.X
# Epson Stylus Color 1520C with 100BTX-NIC from Epson
# CISCO 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
# SonicWall firewall appliance 10meg firmware 3.3.1
Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/CISCO 6509/Trancell Webramp/Xylan Omni Switch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1)
Class Cisco | embedded || switch
Class Xylan | embedded || switch
Class Epson | embedded || printer
Class SonicWall | embedded || firewall
Class Trancell | embedded || router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Leunig ePower Switch b723 v5.2
Class Leunig | embedded || power-device
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Lexmark M412n network printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

#  Lexmark Optra S 1659 (MarkNetS)
#  Lexmark Optra S 2455 and SC 1275
Fingerprint Lexmark Optra S Printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=1393|2726|3AB9|4E4C|61DF%SI=<30)
T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Lexmark Optra T612 (printer) running firmware 3.11.17
# Lexmark Optra S 2420
Fingerprint Lexmark Optra printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark Marknet X2031e printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter
Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Lexmark T522 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark T522/T622 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFW11S4 802.11B WAP
# Linksys BEFSR41 firmware ver. 1.40.2
Fingerprint Linksys BEFW11S4 WAP or BEFSR41 router
Class Linksys | embedded || WAP
Class Linksys | embedded || broadband router
TSeq(Class=TD%gcd=<F4%SI=<500%IPID=Z%TS=U)
T1(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys EtherFast print server 
Class Linksys | embedded || print server
T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys EtherFast print server 
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys WAP11 v2.6 firmware 1.06
Fingerprint Linksys WAP11 Wireless AP
Class Linksys | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WAP11 wireless AP v2.2 firmware 1.06
# DLink DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003
Fingerprint Linksys WAP11 or D-Link DWL-900+ wireless AP
Class Linksys | embedded || WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WET-11 wireless ethernet bridge running firmware rev. 1.43
Fingerprint Linksys WET-11 wireless ethernet bridge
Class Linksys | embedded || bridge
TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Pitney Bowes DL550 photocopier
#  Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823
Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer
Class Pitney Bowes | embedded || printer
Class Konica | embedded || printer
Class Toshiba | embedded || printer
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PS2 Linux 1.0 on Sony PS2 game console
Class Sony | Linux || game console
TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)

# fingerprint!
Fingerprint Linux 1.0.9
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=30|60%SI=<F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.8 - 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<BBBB)
T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=1%SI=1C)
T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.3.20 (X86)
Class Linux | Linux | 1.X | general purpose
T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.0
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.27 - 2.0.30
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# On very rare cases, I get a T2 response back -- weird
Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.34-38
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.0.39
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.24 PowerPC
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.76
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux Kernel 2.1.88
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.91 - 2.1.103
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>7A000)
T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.19 - 2.2.25
Class Linux | Linux | 2.1.X | general purpose
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.2.20 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# SuSE Linux 6.3 (i386) - Kernel 2.2.13
Fingerprint Linux kernel 2.2.13 (SuSE; X86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.5 - 2.2.13 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.12 - 2.2.19
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.2.13
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.2.14
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

Fingerprint Linux 2.2.19 - 2.2.20
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.2.19 on a DEC Alpha 233mhz Multia
Fingerprint Linux 2.2.19 on a DEC Alpha
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

# IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/
Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall
Class IPCop | Linux | 2.2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.2.21 SMP (X86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.2.22
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.12
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<20%SI=>DDDD)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.28-33
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.49 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.6 as on Sharp Zaurus PDA
Class Linux | Linux | 2.4.X | PDA
TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux Kernel 2.4.0-test5
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

# Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586
Fingerprint Linux kernel 2.2.16
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.4.18 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.4.19 (X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux Kernel 2.4.0 - 2.5.20
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0|8|14|20|28|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Linux kernel 2.4.18 on Alpha EV4
# Linux Kernel 2.5.70 (X86)
Fingerprint Linux Kernel 2.4.18 - 2.5.70 (X86)
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-4GB-athlon i686
# SuSE Linux 8.2 2.4.20-64GB-SMP
Fingerprint Linux Kernel 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ)
T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.7 (zLinux on OS/390)
Fingerprint Linux 2.4.7 (zLinux on OS/390)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ)
T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Strangely enough, I have received several prints like this that claim a T2:
Fingerprint Linux 2.4.16 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux Kernel 2.4.0 - 2.5.20 w/o tcp_timestamps
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# linux kernel 2.4.20 (i586) Preemptible
# Linux kernel 2.4.18
Fingerprint Linux kernel 2.4.18 - 2.4.20 (X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# I don't put "Gentoo" as the vendor for the classification because it
# makes output ugly when there are a bunch of Linux matches due to
# firewalling or similar problems.
Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z)
T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20 (Gentoo 1.2; X86)
# Linux Kernel 2.4.18-14
Fingerprint Linux 2.4.18 - 2.4.20 (X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux Kernel 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.19 w/grsecurity patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux kernel 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.20-gentoo-r5 w/grsecurity
Fingerprint Linux 2.4.20 - 2.4.21 w/grsecurity.org patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.5.25 - 2.5.70 or Gentoo 1.2 Linux 2.4.19 rc1-rc7)
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Kernel 2.4.3-2.10.1smp (RedHat 7.0.98 Wolverine)
Fingerprint Linux Kernel 2.4.3 SMP (RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E7A750&>76F8A%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.7 (X86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.17 on HP 9000 s700
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Astaro Security Linux 4 (Kernel 2.4.19)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# http://www.sics.se/~adam/lwip/
Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32
Class lwIP | lwIP || general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U)
T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Not really constant -- just slow incrementation
# This is an LCIII
Fingerprint Apple Mac OS 7.1
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C)
T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C|TD)
T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.5.5 - 9
Class Apple | Mac OS | 7.X | general purpose
Class Apple | Mac OS | 8.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.0
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8 running on an LC 475
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.5
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Apple Mac OS 9.2.2
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX B.11.00
Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00
Class Apple | Mac OS | 9.X | general purpose
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<9%SI=>3FFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2?
Fingerprint Apple Mac OS X Server 10.1.2 (ppc)
Class Apple | OS X | 10.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Magna SG10 intranet router
Class Magna | embedded || router
TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
Class FreeBSD | FreeBSD | 4.X | general purpose
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Maxim-IC TiniOS DS80c400
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint MegaBit Gear TE4111C modem
Class Megabit | embedded || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Class Meridian | embedded || storage-misc
TSeq(Class=TD%gcd=40000%SI=<A)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8
Class Xylogics | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Microplex Print Server
Class Microplex | embedded || print server
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Microplex M205 Pocket Print Server v5.7
# IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ]
Fingerprint IBM 6400 printer or Microplex Pocket Print Server
Class IBM | embedded || printer
Class Microplex | embedded || print server
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
Class Atari | Atari || game console
TSeq(Class=TD%gcd=3E7%SI=0)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Minix 32-bit/Intel 2.0.0
Class Minix | Minix || general purpose
TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF)
T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T4(Resp=N)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint minix v2.0.2 32bits
Class Minix | Minix || general purpose
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Minix 32-bit/Intel 2.0.3
Class Minix | Minix || general purpose
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MiraPoint messaging server v3.1
Class MiraPoint | embedded || general purpose
TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0)
Class MiraPoint | embedded || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3
Fingerprint Motorola SurfBoard SB4100E Cable Modem
Class Motorola | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Motorola SurfBoard 4401 provided by adelphia
Fingerprint Motorola SurfBoard 4401 cable modem
Class Motorola | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E)

Fingerprint Motorola System V/68 version R3V7 on a 68030
Class Motorola | BSD-misc || general purpose
TSeq(Class=RI%gcd=<14%SI=<52F8&>C0)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4
Class Vanguard | embedded || router
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6
Class Vanguard | embedded || router
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint MultiTech CommPlete (modem server) RAScard
Class MultiTech | embedded || terminal server
TSeq(Class=TD%gcd=388|710|A98%SI=<44)
T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NEC UX/4800
Class NEC | UX/4800 || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded)
Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91)
Class NCD | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)


Fingerprint NCR MP-RAS 3.0.x
Class NCR | BSD-misc || general purpose
TSeq(Class=64K)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCR MP-RAS 3.01
Class NCR | BSD-misc || general purpose
TSeq(Class=i800)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NCSA Telnet (dos)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# I'm not 100% sure this version is for DOS, just a guess
Fingerprint NCSA Telnet 2.3.08 for the PC (DOS)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Host information:  @WorkStation (i960 based) X-terminal
# Neoware (was HDS) NetOS V. 2.0.1
# Hewlett-Packard ENTRIA Model C3230A Server Version B.05.30
# Cisco 11151/Arrowpoint 150 Load Balancer
Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP ENTRIA C3230A
Class Neoware | NetOS || X terminal
Class HP | embedded || X terminal
Class Cisco | embedded || load balancer
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetApp F360 or 760 Filer
Class NetApp | Data OnTap || fileserver
TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp Data OnTap 6.1.2R3 on an F840 filer
Class NetApp | Data OnTap || fileserver
TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# NetApp DataOnTap Release 6.3.1: Wed Nov 20 13:03:17 PST 2002
Fingerprint NetApp DataOnTap Release 6.3.1
Class NetApp | Data OnTap || fileserver
TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp NetCache C760 os 4.x
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint NetApp NetCache running OS 5.4R2
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetApp Data OnTap 3.1.6 or BSDi 1.1
Class NetApp | Data OnTap || fileserver
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetApp Data OnTap 5.1.2 - 5.3.5r2
Class NetApp | Data OnTap || fileserver
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E)

# NetCache 5.1D4 on a NetApp C1100 Box
Fingerprint Network Appliance NetCache 5.1D4
Class NetApp | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>):
# * The set of options in a SYN-ACK depends on the state of the
#   `net.inet.tcp.rfc1323' flag.
# * Releases prior to 1.3 did not randomize the ISS at all.
# * Releases prior to 1.3 incorrectly added the IP header length to the IP
#   packet length when returning an ICMP unreachable.
# * Releases prior to 1.3 calculated the window size slightly wrong.
# * Releases prior to 1.3 returned a non-zero window size when sending a RST
#   in response to an ACK on a listening socket (thereby making them
#   susceptible to stealth scanning).
# * Releases prior to 1.3H/1.3.4 did not return a response to the null flag
#   test (thereby making them susceptible to stealth scanning).
# * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in
#   the encapsulated IP header when sending an ICMP reply.  On little endian
#   machines the IP ID field was byte-swapped.  The checksums were always
#   zeroed.
# * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when
#   MTU discovery was enabled.

Fingerprint NetBSD 1.0 i386
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.0 little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.0 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.2 - 1.2.1 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3 - 1.3.3 little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3 - 1.3.3 big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NetBSD 1.3H-1.5  big endian arch
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# NetBSD 1.3I (after 19990119)
# NetBSD 1.4 x86
# NetBSD 1.6L/Alpha
# NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386
Fingerprint NetBSD 1.3I through 1.6
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.5_ALPHA i386
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD/Alpha 1.5.2 on a DEC 3000/300 LX
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot)
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint NetBSD 1.6
Class NetBSD | NetBSD || general purpose
TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Netgear FM144P ProSafe Wireless Firewall with Print Server
# Repotec IP515H Cable Router / Print Server
Fingerprint Netgear FM144P/Repotec IP515H Router & Print Server
Class Netgear | embedded || broadband router
TSeq(Class=TD%gcd=<104%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Netopia 4541 ADSL router v5.3.4
# Netopia R7100 SDSL router
Fingerprint Netopia 4541/R7100 DSL router
Class Netopia | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Netopia DSL router
Class Netopia | embedded || broadband router
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetScreen-100
Class NetScreen | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<276A&>50)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)



Fingerprint NetSilicon NetARM running ThreadX 2.0
Class NetSilicon | ThreadX || specialized
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nokia IPSO 3.2-3.2.1 releng 783-849
# IPSO 3.4-FCS4A releng 767  Running CheckPoint 4.1 SP6
# Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
# Nokia IPSO 4.3.1-FCS5
Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.2 Running Checkpoint Firewall-1
# IPSO 3.5-FCS8 releng 1020  Running Checkpoint FW-1 NG FP2
Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)

# Nokia IPSO 3.6 FCS 6 releng 1061  01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplimental
Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2
Class Checkpoint | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08)
Fingerprint Nokia M1122 DSL Router
Class Nokia | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Netopia R3100-I DSL Router Firmware version v4.7.2
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetJet Version 3.0 - 4.0 Printer
Class NetJet | embedded || printer
TSeq(Class=TD%gcd=<4%SI=<4)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Netscreen 5XP firewall + vpn (OS 3.0.1r2)
Class Netscreen | embedded || firewall
TSeq(Class=TD%gcd=1000%SI=<FF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0)
Class Netscreen | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)


Fingerprint Network Systems router NS6614 (NSC 6600 series)
Class Network Systems | embedded || router
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U
Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router
Class Nexland | embedded || broadband router
TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# A NeXT Turbo, unknown version number
Fingerprint NeXT Mach
Class NeXT | Mach || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2)
Class Nokia | IPSO || firewall
TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42
Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B
Class Alteon | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=RD)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Nortel Networks BayStack 450-24T Versions: HW:RevL  FW:V1.48 SW:v4.2.0.16 ISVN:2
Fingerprint Nortel Networks BayStack switch
Class Nortel | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nortel CallPilot 100 voicemail system
# 3com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version:  V1.12
# Cisco 1538M micro hub running latest firmware
# HP TopTools Remote Control Card
# Enterasys VH2402 Switch Firmware 2.05.02 
# NTT East VoIP gateway of some sort (  http://www.ntt-east.co.jp/ced/goods/voip/index.html )
Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub
Class Nortel | embedded || telecom-misc
Class NTT | embedded || telecom-misc
Class 3Com | embedded || switch
Class Cisco | embedded || hub
Class Enterasys | embedded || switch
Class HP | embedded || specialized
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02
Class Nortel | embedded || terminal server
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0
Class Nortel | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Novell NetWare 3.12 or 386 TCP/IP
Class Novell | Netware | 3.X | general purpose
TSeq(Class=TD%gcd=<6B4A%SI=<1E)
T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 3.12 - 5.00
Class Novell | Netware | 3.X | general purpose
Class Novell | Netware | 4.X | general purpose
Class Novell | Netware | 5.X | general purpose
TSeq(Class=TD%gcd=10|20|30|40%SI=<64)
T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME)
T4(Resp=N)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5
Class Novell | Netware | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0)
T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint NetWare 4.11 SP8a - Netware 5 SP4
Class Novell | Netware | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88)
T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.0 with Border Manager
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<5%SI=>BBBBB)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Novell Netware 5.x
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Netware 5.0 SP 3a
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell Netware 5 Support Pack Revision 06 Server Version 5.00.09
Fingerprint Novell Netware 5.00.09 SP06
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 4.11-5.0SP5
Class Novell | Netware | 4.X | general purpose
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Netware 5.1 SP3
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 5.1-6.0
Class Novell | Netware | 5.X | general purpose
Class Novell | Netware | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell NetWare 5.1SP4 - 6.0
Class Novell | Netware | 5.X | general purpose
Class Novell | Netware | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 5.1 SP5 with Groupwise
Class Novell | Netware | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell Netware 5.1 SP5 with Groupwise
Fingerprint Novell Netware 5.1 SP5
Class Novell | Netware | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Novell Netware 6 SP1
Class Novell | Netware | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Novell Netware 6sp2 running BM3.7 (with no service packs)
Fingerprint Novell Netware 6 SP2
Class Novell | Netware | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint NSG 500 router. OS version 7.6.1 (http://www.nsg.ru)
Class NSG | embedded || router
TSeq(Class=TD%gcd=<14004%SI=<28%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel)
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenStep 4.1/NeXTStep 3.3
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint NeXTStep/OpenStep 4.2/Intel
Class NeXT | NeXTStep || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Okidata 7200 Printer
Class Okidata | embedded || printer
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint OpenBSD 2.1 - 2.3/SPARC
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FF)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# This fingerprint had LAND patch installed
Fingerprint OpenBSD 2.1/X86
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.2 - 2.3
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# With more info provided by Theo De Raadt
# OpenBSD 2.6
Fingerprint OpenBSD 2.6-2.8
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.6-2.8
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B)
T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 )
Class OpenBSD | OpenBSD | 2.7 | general purpose
TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.8 (X86)
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.9-beta through release (X86)
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint OpenBSD 2.9-stable
Class OpenBSD | OpenBSD | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenBSD 3.0 (x86 or SPARC)
# OpenBSD 3.3 (hppa)
# OpenBSD 3.3 (GENERIC) i386
Fingerprint OpenBSD 3.0 or 3.3
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.0-STABLE (X86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all" feature
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 on an Alpha
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 (X86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.1 (X86)
Class OpenBSD | OpenBSD | 3.X | general purpose
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.2 with pf scrub and no-df
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.2 (X86)
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint OpenBSD 3.3
Class OpenBSD | OpenBSD | 3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Savin 9927 Copier
Class Savin | embedded || printer
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Sequent DYNIX/ptx(R) V4.2.1
Class Sequent | embedded || general purpose
TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Sequent DYNIX/ptx(R) V4.4.6
Class Sequent | embedded || general purpose
TSeq(Class=RI|TD%gcd=<6%SI=<3FC)
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens HiCom 300E business phone system Release 6.5
Class Siemens | embedded || VoIP phone
TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Siemens HICOM 300 Phone switch (PBX) (WAML LAN card)
Fingerprint Siemens HICOM 300 Phone switch (PBX)
Class Siemens | embedded || PBX
TSeq(Class=64K)
T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=)
T4(DF=N%W=808%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Siemens HICOM Phone switch (PBX)
Class Siemens | embedded || PBX
TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45
Class Siemens | ReliantUNIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-N 5.43C3002
Class Siemens | SINIX || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-N 5.41C0005
Class Siemens | SINIX || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E)

Fingerprint SINIX-Y 5.43B0045
Class Siemens | SINIX || general purpose
TSeq(Class=64K)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens SINIX-Y 5.43C4001
Class Siemens | SINIX || general purpose
TSeq(Class=RI%gcd=<6%SI=<26E76&>625)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Siemens Speedstream 2602 DSL/Cable router
Class Siemens | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Smoothwall Linux-based firewall 2.2.23
Class Smoothwall | Linux | 2.2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SonicWall/10 firewall
Class SonicWall | embedded || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME)
T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall SOHO-3 firewall
Class SonicWall | embedded || firewall
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall SOHO-3 firewall
Class SonicWall | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SonicWall/10 Firewall
Class SonicWall | embedded || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SONY NewsOS 6.1.2
Class Sony | NewsOS || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sega Dreamcast game console
Class Sega | embedded || game console
TSeq(Class=TD%gcd=<780%SI=<14)
T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint StackTools StackTos 1.0 embedded networking OS
Class StackTools | StackTos || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Proxim Stratum MP FW: 7_8_18;  managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18
Fingerprint Proxim Stratum MP wireless bridge
Class Proxim | embedded || bridge
TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Stratus VOS Release 14.3.1ae
Class Stratus | VOS || general purpose
T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2
Class Symantec | Windows | NT/2K/XP | firewall
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

# http://www.systech.com/catalog/RCS3000Entry.html
# RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18)
Fingerprint Systech RCS/3182 ethernet serial port server (firmware 06D)
Class Systech | embedded || specialized
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V2R10
Class IBM | OS/390 | V2 | general purpose
TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V5R0M0
Class IBM | OS/390 | V5 | general purpose
TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4 r4-5
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999
Class Packet Engines | embedded || router
TSeq(Class=64K)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Panasonic KX-HCM10 network camera
Class Panasonic | embedded || webcam
TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Packeteer IP-PacketShaper 2000 V3.1
Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1
Class Packeteer | pSOS || load balancer
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05
Class Packeteer | pSOS || load balancer
TSeq(Class=64K)
T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200
Class Panasonic | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Panasonic panafax DX2000 SuperG3 fax machine
Class Panasonic | embedded || printer
TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Pigtail Express VoIP phone (runs VxWorks)
Class Pigtail | VxWorks || VoIP phone
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Second Edition
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Release 4 (x86)
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Planet WAP 1950 Wireless Access Point
Class Planet | embedded || WAP
TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Polycom ViewStation 512K videoconferencing system
Class Polycom | embedded || webcam
TSeq(Class=C)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Polycom ViewStation
Class Polycom | embedded || webcam
TSeq(Class=C)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2)
Class PolyCom | embedded || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
Class IBM | embedded || router
Class Proteon | OpenRoute || router
TSeq(Class=TD%gcd=<6%SI=<BB)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Proteon OpenRoute 3.0 gt series router
Class Proteon | OpenRoute || router
TSeq(Class=TD%gcd=1%SI=0)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint QMS Magicolor 2200 DeskLaser printer
Class QMS | embedded || printer
T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint QNX 4.24 - 4.25 realtime embedded OS
Class QNX | QNX || general purpose
TSeq(Class=64K)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint QNX 6.00 realtime embedded x86
Class QNX | QNX || general purpose
TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Racal 7100 Host Security Module 1.05 / 5.05
Class Racal | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Radionics Ram IV Alarm System
# Lantronix CoBox DR1-IAP serial device server
Fingerprint Lantronix CoBox serial device server or Radionics Ram IV Alarm
Class Lantronix | embedded || terminal server
Class Radionics | embedded || specialized
TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U)
T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Raptor firewall 5.03 on NT 4
Class Raptor | embedded || firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Raptor Firewall 6 on Solaris 2.6
Class Raptor | Solaris | 2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint RCA/Thomson cable modem DCM-235/245
Class RCA | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Redback SMS 1000-2000 DSL Router
Class Redback | embedded || broadband router
TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE
Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.4.0
Class Redback | AOS || router
TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0|F%ULEN=134%DAT=E)

# Redback SMS 1800 router AOS Release 5.0.3.8
# Redback Networks SMS 10000 AOS 6.0.5.0
# Thomson TMC 390 cable modem
Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem
Class Redback | AOS || router
Class Thomson | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Redback SMS 1800 router
Class Redback | AOS || router
TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000
Class Siemens | ReliantUNIX || general purpose
TSeq(Class=64K)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Ricoh Aficio AP4500 Network Laser Printer
Class Ricoh | embedded || printer
TSeq(Class=C%Val=0)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ringdale RP21 Print server
Class Ringdale | embedded || print server
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SCO UNIX release 3.2
Class SCO | SCO UNIX || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint SCO OpenServer Release 5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer(TM) Release 5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6)
T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO OpenServer 5.0.5
Class SCO | OpenServer || general purpose
TSeq(Class=RI%gcd=<5%SI=>FFFF)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120
Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120
Class Cray | Unisys || general purpose
TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint SCO UnixWare 2.01
Class SCO | UnixWare || general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 2.1
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 2.1.2
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<BB%SI=>FFFF)
T1(W=60F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=)
T4(W=0%ACK=O%Flags=R%Ops=)
T5(W=0%ACK=S++%Flags=AR%Ops=)
T6(W=0%ACK=O%Flags=R%Ops=)
T7(W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.1.0 x86
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70)
T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86)
Class SCO | UnixWare || general purpose
TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ)
T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SCO Open Desktop ( Same as SCO UNIX?)
Fingerprint SCO Open Desktop 2.0
Class SCO | SCO UNIX || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Secure Computing Sidewinder firewall 3.2 update 4
Class Secure Computing | embedded || firewall
TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Secure Computing Sidewinder firewall 5.2.1.06
Class Secure Computing | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Secure Computing SECUREZone Firewall Version 2.0
Class Secure Computing | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sharp Digital Imager (copier) AR-507
Class Sharp | embedded || printer
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

#  Shiva AccessPort Bridge/Router Software V 2.1.0
#  3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59
Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59
Class Shiva | embedded || router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Shiva LanRover/8E Version 3.5
Class Shiva | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Quantum Snap Server Network Storage Box
Class Quantum | embedded || storage-misc
TSeq(Class=i800)
T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Quantum Snap server 4100
Class Quantum | embedded || storage-misc
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Sun Remote System Console version 1.12
# Brocade Fibre Switch, Firmware 2.6.0
Fingerprint Brocade Fibre Switch or Sun Remote System Console
Class Brocade | embedded || switch
Class Sun | embedded || specialized
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.3 - 2.4
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc)
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.5, 2.5.1
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise
Fingerprint Sun Solaris 2.6 (SPARC)
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 (SPARC)
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1)
T1(DF=Y%W=2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297|212%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T3(Resp=N)
T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL)
T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 X86
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6
Class Sun | Solaris | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8)
T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=64K)
T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2
Class Sun | Solaris | 2.X | general purpose
Class Sun | Solaris | 7 | general purpose
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 8 early access beta through actual release
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ)
T1(DF=Y%W=5B4|60DA|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60
Fingerprint Sun Trusted Solaris 8
Class Sun | Solaris | 8 | general purpose
TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Sun Solaris 9 Beta through Release on SPARC
# solaris 9 i386
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2
Class Sun | Solaris | 9 | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Convex SPP-UX 5.2.1
Class Convex | SPP-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SPP-UX 5.x on a Convex SPP-1600
Class Convex | SPP-UX || general purpose
TSeq(Class=C)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun SunOS 4.0.3
Class Sun | SunOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI
Class Sun | SunOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative)
Class Sun | SunOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)

Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7)
Class Sun | SunOS || general purpose
T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code
# Integrated Access Platform, Software Version  = 12.1.1.22 (ISDN Software Version 10.1)
Fingerprint Ericsson Tigris Access Server Software V. 12.1.*
Class Ericsson | embedded || terminal server
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Tahoe OS 1.2.1 running on Tahoe router
Class Tahoe | Tahoe OS || router
TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Tally 9112 Printer
Class Tally | embedded || printer
TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Tandberg X-terminal
Class Tandberg | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Tandem NSK D39
Class Tandem | Tandem NSK || general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Tandem NSK D40
Class Tandem | Tandem NSK || general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Tektronix Phaser 350 firmware 3.3 (printer)
Class Tektonix | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Tektronix Phaser 360 Extended
Fingerprint Tektronix Phaser 360 printer
Class Tektonix | embedded || printer
TSeq(Class=i800)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# From a Tektronix Phaser 350
Fingerprint Tektronix Phaser(TM) printer with share ethernet card, firmware version 3.01
Class Tektonix | embedded || printer
TSeq(Class=RI%gcd=<F%SI=>888&<4444)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Tektronix Phaser 560 printer
Class Tektonix | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U)
T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Telebit's NetBlazer 3.0 router
Class Telebit | embedded || router
TSeq(Class=TD%gcd=<100004%SI=<3C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Telebit NetBlazer router Version 3.05
Class Telebit | embedded || router
TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# (Telebit router - 18 async/1 ether)
Fingerprint Telebit NetBlazer Version 3.1, patch level 13
Class Telebit | embedded || router
TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Telindus 11xx ADSL Router
Class Telindus | embedded || broadband router
TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Telocity (DirectTVDSL) Gateway x2 Model
Class Telocity | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Teltrend (aka Securicor 3net) Router
Class Teltrend | embedded || router
TSeq(Class=TD%gcd=388|710%SI=<F)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Toshiba TR650 ISDN Router
Class Toshiba | embedded || broadband router
TSeq(Class=TD%gcd=<9%SI=<14)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# TurtleBeach Audiotron with firmware 3.0.0
Fingerprint TurtleBeach Audiotron network MP3 player
Class Turtle Beach | embedded-misc || specialized
TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Audiotron with 3.0.26 Firmware
Fingerprint TurtleBeach Audiotron network MP3 player
Class Turtle Beach | embedded-misc || specialized
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.turtlebeach.com/site/products/audiotron/producthome.asp
Fingerprint Turtle Beach AudioTron 100 network MP3 player
Class Turtle Beach | embedded-misc || specialized
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC Ultrix 4.1
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ultrix 4.2 - 4.5
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint US Robotics USR8022 broadband wireless router (WAP)
Class US Robotics | embedded || WAP
TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U)
T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5)
Fingerprint US Robotics broadband router (model #8000-02)
Class US Robotics | embedded || WAP
TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint US Robotics Total Control NETServer Card
Class US Robotics | embedded || terminal server
TSeq(Class=C%Val=7F)
T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R
Class 3Com | embedded || switch
TSeq(Class=C|TD%gcd=3D090%SI=0)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server
Class VersaNet | embedded || terminal server
TSeq(Class=TD%gcd=<2004%SI=<14)
T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM
Class Virtual Access | embedded || router
TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

#  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
# Bay Networks MicroAnnex XL running firmware 10.0B
Fingerprint VxWorks 5.3.x bases system (usually an ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server
Class HP | VxWorks || switch
Class Bay Networks | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint WatchGuard Firebox SOHO V5.x firewall
Class WatchGuard | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2.
Fingerprint Minolta QMS Printer running VxWorks 5.4.2
Class Minolta | VxWorks || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B
Class Microsoft | Windows | 3.X | general purpose
TSeq(Class=TD%gcd=10000%SI=<FF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98
Class Microsoft | Windows | 3.X | general purpose
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<F%SI=<F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Win95 4.00.950B  -  IE 5 5.50.4807.2300
Fingerprint Microsoft Windows 95 4.00.950B
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Windows NT 3.10 (Build 528)
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U)
T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows NT 3.51 SP5
Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0)
T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 98 4.10.2222.A
# "Windows 98 Second Edition, patched up to date" (1/25/03)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98 Second Edition (build 2222)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE + IE5.5sp1
Class Microsoft | Windows | 95/98/ME | general purpose
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

Fingerprint Microsfot Windows 98SE with security patch A
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 4.10.1998
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U)
T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP2
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE 4.10.2222A
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP5-SP6
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<DA16&>21A)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows NT4 Workstation SP6a
# windows nt4 swith service pack 6
Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U)
T1(DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a
Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U)
T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
PU(Resp=N|Y)

Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U)
T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# HP Journada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100
Fingerprint HP Journada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA)
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFF)
T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP1
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<5%SI=<20)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows NT 5 Beta2 or Beta3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TD%gcd=<6%SI=<1000)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows.NET Enterprise Server (build 3615 beta)
# windows .net standard server build 3604
# Microsoft Windows 2003 Standard Build V5.2.3790 build 3790
Fingerprint Microsoft Windows .NET Enterprise Server (build 3604-3790)
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, Enterprise Edition, Build 3790
# Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
Fingerprint Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows Server 2003 Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows Server 2003
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from microsoft as at 06/03
Fingerprint Microsoft Windows Server 2003 Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Server 2003, build 3790
Fingerprint Microsoft Windows Server 2003
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Millenium Edition v4.90.300
# Windows Me or Windows 2000 RC1 through final release
# Microsoft Windows 2000 Advanced Server
# Windows 2000 with SP2 and long fat pipe (RFC 1323)
# Windows 2000 Professional servicepack 3
# Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes
# Windows 2000 Professional (x86)
# Compaq ProLiant DL-380G2 running windows 2000 with SP3 and all the current patch sets (2/3/03)
# Winodws XP professional version 2002 on PC Intel processor
# Windows XP Build 2600
# XP Professional 5.1 (build 2600).. all patches up to June 20, 2002
# Fingerprint Windows XP Pro with all current updates to May 2002
# Windows 2000 Version 5.0 Build (2195: Service Pack 3)
#  Windows 2000 Advanced Server sp3
Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0)
T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2000 Server  with service pack 3 and MS-Exchange 2000 Server
Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows ME + all updates as of 1/1/03
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I)
T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:service pack 1)
Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U)
T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 version 5 build 2195 Service Pack 2
Fingerprint Microsoft Windows 2000 SP2
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I)
T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U)
T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Pro SP2
# Microsoft  Windows XP Pro SP1
Fingerprint Microsoft Windows 2000 Professional SP2 or Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<270D8&>3E9%IPID=I)
T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I)
T1(DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I)
T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2000 5.00.2195 with SP 3
Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<876AE&>98E)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# windows 2000 professional build 2195 service pack 3
Fingerprint Microsoft Windows 2000 Professional SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U)
T1(DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I)
T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02
Fingerprint Microsoft Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I)
T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
T1(DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Professional
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C476&>472)
T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2000 Build 2195 Service Pack 1
Fingerprint Microsoft Windows 2000 SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)


Fingerprint Microsoft Windows XP Home Edition
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U)
T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional or Windows 2000 Professional SP2+
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I)
T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

#  Microsoft Windows 2000 with service pack 3
# Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of February 1st, 2003
Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP
Class Microsoft | Windows | NT/2K/XP | general purpose
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<20%SI=<E92A&>240)
T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE)
T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional RC1+ through final release
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I)
T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1)
Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > lateste +windows update patch too (1/31/03)
# Windows 2000 with service pack 3
Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# windows xp pro WITHOUT ANY service packs
# windows xp sp1
Fingerprint Microsoft Windows XP Professional
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U)
T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U)
T1(DF=Y%W=8820%ACK=S++|O%Flags=AS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8820%ACK=S++|O%Flags=AS||A%Ops=M||)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows XP Pro Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1)
Fingerprint Microsoft Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U)
T1(DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows XP Pro SP1
# Microsoft Windows2000 advaned Server with Service pack3
Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 Advanced Server SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U)
T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional Version 5.1 Build 2600
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I)
T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Windows XP Pro Build 2600.xpsp1.020828-1920 with Windows Services for Unix 3.0 installed
# Windows 2000 Advanced Server with SP3
# Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3
# Windows 2000 SP3
Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 SP3
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I)
T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I)
T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Xp Pro service pack 1 version 5.1 - Build  2600
Fingerprint Microsoft Windows XP Professional SP1
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I)
T1(DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Xbox (modified) running evolutionX
Class Microsoft | embedded || game console
TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U)
T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Xbox V1.1 Running Evolution-X Dashboard v1.8.3752
Fingerprint Microsoft Xbox (modified) running evolutionX
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U)
T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Xbox running Debian Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)


Fingerprint WNOS 5.0 on Microsoft DOS 6.22
Class Microsoft | DOS || general purpose
TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WTI Network Power Switch v3.02
Class WTI | embedded || power-device
TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint XCD Xconnect print server, firmware version CC8S-3.58 (98.09.21)
Class XCD | embedded || print server
TSeq(Class=TD%gcd=<272A%SI=<1E)
T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Xerox 8830 Plotter
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=1000%SI=1)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox Document Centre ColorSeries 50
Class Xerox | embedded || printer
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services
Class Xerox | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xerox DocuPrint C55
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox DocuPrint N40
Class Xerox | embedded || printer
TSeq(Class=TD%gcd=<2004%SI=<8C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Xerox Docuprint N2125 network printer
Class Xerox | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint xMach free distributed OS version 0.1 current
Class xMach | xMach || general purpose
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xylan OmniSwitch 5x/9x ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2
Class Xylan | embedded || switch
Class Xylogics | embedded || terminal server
Class Hitachi | HI-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware
Class Xyplex | MAXserver || terminal server
TSeq(Class=C|TD%gcd=<5%SI=<5)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS
Class Xylogics | LynxOS || terminal server
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16
Class Cabletron | embedded || router
TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Cabletron Smart Switch Router 8600
Class Cabletron | embedded || router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# CasheFlow CacheOS (CacheFlow 500-5000 webcache) CFOS 2.1.08 - 2.2.1
Fingerprint CasheFlow CacheOS (CacheFlow 500-5000 web proxy cache) CFOS 2.1.08 - 2.2.1
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router
Class CastleNet | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.cayman.com/
Fingerprint Cayman 2E DSL/CABLE router
Class Cayman | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Chase IOLAN Terminal Server v3.5.02 CDi
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed
# that test
Fingerprint Chase IOLAN terminal server
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Xyplex Network 9000 terminal server
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=<6%SI=<6)
T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Xyplex Terminal Server v6.0.2S5
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=1388%SI=<F)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

# Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP)
Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4
Class Xyplex | embedded || terminal server
TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
PU(Resp=N)

# Zero One Tech. Print Server 3000
# Hawking Print Server PN7117
# Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049)
# EUSSO Technologies UPS1211-B print server
Fingerprint Print Server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B
Class Hawking | embedded || print server
Class Zero One | embedded || print server
Class EUSSO | embedded || print server
TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ZoomAir IG-4165 wireless gateway (WAP)
Class ZoomAir | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ZyXEL ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003
Fingerprint Zyxel XyWALL 50 (ZyNOS 3.52)
Class Zyxel | ZyNOS || firewall
TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

#Zyxel P128imh or P480 router (ZyNOS)
#ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002
#Intel Express 8100 Router ISDN
Fingerprint Zyxel ZyNOS based broadband router (ZyNOS) or Intel Express ISDN router
Class Zyxel | ZyNOS || broadband router
Class Intel | embedded || broadband router
TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|%SI=<FF%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Zyxel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9)
Fingerprint Zyxel Prestige 642R-11 ASDL router running ZyNOS
Class Zyxel | ZyNOS || broadband router
TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ZyXEL P480 ISDN router running ZyNOS v2.42(O.00)
Class Zyxel | ZyNOS || broadband router
TSeq(Class=TD%gcd=<2004%SI=<1E)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Hardware: Zyxel Prestige broadband router
Class Zyxel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# ZyXEL Prestige 700 broadband router
# Netgear MA314 Cable/Wireless Router
Fingerprint ZyXEL Prestige 700/Netgear MA314 broadband router
Class Zyxel | ZyNOS || broadband router
T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)