Passive OS fingerprinting.

The classic on OS fingerprinting is here. Active OS fingerprinting relies on sending packets (mostly TCP and ICMP) to open or closed ports and observing the answer, but this is rude.

p0f is a passive OS fingerprinting that allows for all sort of interesting application. It works best when it sits waiting for packets to showup for analysis. For instance, it could be installed on a web server to look at incoming TCP packets to find out what is connecting to it.

Here's how it figures certain things:

• the uptime: the timestamp on SYN requests here (but this depends on the OS: Linux seems to be using ctime, Windows is using some HZ increment.)
  
• The link type: with the gathered MSS/MTU (packet -vs- payload size) values
• NAT: analyzing disparities in fingerprinting received for the same IP (link type, OS identification, etc...)

Just a few hints:

• Look at the TTL value in the received packet and do a traceroute to figure the TTL: 64 is common for Linux/BSD, 128 could be a Windows box
• Look at the Window Size: 0x1600/0x2D00 or so and somewhat constant through the connection is common for Linux.
• Changing through the life of the connection is common for Windows.

Mention of p0f fetched here.