# Mingsweeper 1.00a5 generated IP Stack Fingerprints
# www.hoobie.net/mingsweeper/

DefinedBaseTypes Cisco Device,Ascend Device,BSD Unix,Firewall Device,Linux,Solaris Unix,Digital VMS,MS Win NT/2K,MS Win 9x   

Fingerprint AIX 4.1.4	# rs-6000 hardware
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD 2.x
BaseType BSD Unix
TSeq(Class=64K)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD x.x 	# unknown version
BaseType BSD Unix
TSeq(Class=RI%gcd=<3%SI=<DFFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD (i386)	# i386 hardware, unknown version
BaseType BSD Unix
TSeq(Class=RI%gcd=<3%SI=<FFFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=64)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=64)

Fingerprint BSDI 4.0.1
BaseType BSD Unix
TSeq(Class=RI%gcd=<4%SI=>FFF&<12000)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Nokia IPSO Firewall	# 
BaseType Firewall Device 
TSeq(Class=RI%gcd=1%SI=<1FFFF)
T1(%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint AIX 4.4
TSeq(Class=TR)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint IRIX # unknown version
BaseType 
TSeq(Class=RI%gcd=20|A0%SI=>A&<FFF)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Linux 2.0.34
BaseType Linux
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)	# returns the bogus flag
T2(Resp=N)
T3(DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.0.38	# hoobie
BaseType Linux
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.2.12	# 
BaseType Linux
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.2.16	#  
BaseType Linux
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Netopia R5100	# v4.8.2
TSeq(Class=i800)
T1(%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=04)
msI2(Resp=N)
msI3(Resp=N)

Fingerprint Linux 2.2.17	# ninjux
BaseType Linux
TSeq(Class=RI%gcd=<15%SI=>FFFFF)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.4.3
BaseType Linux
TSeq(Class=RI%gcd=<4%SI=<3FFFFF)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=Y%C=00%DFE=Y%TOS=C4)

Fingerprint Cisco 160x IOS 12.1 	# 
BaseType Cisco Device
TSeq(Class=RI%gcd=<A%SI=<FFFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N%C=%DFE=%TOS=)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 250x IOS 11.1
BaseType Cisco Device
TSeq(Class=RI%gcd=<6%SI=>A00)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 3000 Series IOS 11.1 		# where's the tseq?
BaseType Cisco Device
T1(%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco Cat 5000/RSM IOS 12.1 	# 
BaseType Cisco Device
TSeq(Class=TR)
T1(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 7206 VXR Router
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=<FFF&>F)
T1(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 3620 IOS 11.2(11)
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=<7FFF)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=04)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=04)

Fingerprint Cisco 3640 IOS 12.0(7)T
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=<7FFF)
T1(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=04)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=N%TOS=04)

Fingerprint Cisco 3640 IOS 12.0(7)	# mmmmm, why the different TOS?
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=<7FFF)
T1(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 4700M Router IOS 12.0(9)
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=<7FFF)
T1(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=00)

Fingerprint Cisco 2500 Router IOS 11.3(7)T
BaseType Cisco Device
TSeq(Class=RI%gcd=1%SI=>FFF&<FFFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=24)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=24)

Fingerprint Cisco 761 Router v4.2(3.5)
BaseType Cisco Device
TSeq(Class=TD%gcd=A000%SI=<A)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=24)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Cisco PIX 4.4
BaseType Firewall Device 
TSeq(Class=TR)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMET)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Bianca Brick-XS Router
TSeq(Class=RI%gcd=1%SI=<FFF)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Alteon ACE Director 3
TSeq(Class=RI%gcd=2%SI=>FFF)
T1(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=200|2238%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Alteon 708
TSeq(Class=RI%gcd=2%SI=>FFF)
T1(%DF=N%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=1FF%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Intel ER8210 Router (4.11)
TSeq(Class=TD%gcd=10%SI=1|2)
T1(%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=%DFE=N%TOS=00)
msI2(DF=N%C=FF%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Intel ER9535 Router (4.20)
TSeq(Class=TD%gcd=50%SI=1)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(DF=N%C=FF%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Fore Powerhub 7000 (5.04)
TSeq(Class=64K)
T1(%DF=N%W=200%ACK=S++%Flags=AS%Ops=)
T2(%DF=N%W=200%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Ascend Pipeline (5.0A)
BaseType Ascend Device
TSeq(Class=TD%gcd=388%SI=1)
T1(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Ascend Pipeline (6.0.13)
BaseType Ascend Device
TSeq(Class=RI%gcd=1%SI=<FFFF)
T1(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint SuperStack II (9.3)
TSeq(Class=TD%gcd=32%SI=1)
T1(%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(%DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=N%TOS=00)

Fingerprint PIX (?.?) static/conduit?
BaseType Firewall Device 
TSeq(Class=TR)
T1(%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T2(%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T3(%DF=N%W=800%ACK=O%Flags=AR%Ops=WNMET)
T4(%DF=N%W=800%ACK=O%Flags=R%Ops=WNMET)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=%DFE=Y%TOS=)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint PIX (?.?) static/conduit?
BaseType Firewall Device 
TSeq(Class=RI%gcd=<3%SI=<1FFFF)
T1(%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T2(%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T3(%DF=N%W=800%ACK=O%Flags=AR%Ops=WNMET)
T4(%DF=N%W=800%ACK=O%Flags=R%Ops=WNMET)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=%DFE=Y%TOS=)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint IBM 2210 Multi-Protocol Router	# these boxes don't reply consistently
TSeq(Class=TD%gcd=1%SI=<A)
T1(%DF=N%W=0|800%ACK=S++%Flags=AS%Ops=M|ME)
T2(Resp=N)
T3(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(%DF=N%W=0%ACK=S|O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=00%DFE=N%TOS=00)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Flowpoint/SpeedStream 58xx iDSL Router
TSeq(Class=TR)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Flowpoint 2200 SDSL Router (3.0.8)
TSeq(Class=TR)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C0)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C0)

Fingerprint CopperEdge 150/200 DSLAM
TSeq(Class=64K)
T1(%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Riverstone RS 3000 (8.0c.02)
TSeq(Class=RI%gcd=1%SI=>1000&<FFFF)
T1(%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cayman 3220 DSL Router
TSeq(Class=64K)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Alcatel OmniSwitch (3.4.10.32)
TSeq(Class=64K)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Xylan OmniSwitch (3.1.9)
TSeq(Class=64K)
T1(%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(DF=N%C=FF%DFE=Y%TOS=C4)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Solaris 2.5.1 	
BaseType Solaris Unix
TSeq(Class=RI%gcd=<7%SI=<1FFFF)
T1(DF=Y%W=2332|8377%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(DF=Y%C=FF%DFE=Y%TOS=C4)
msI3(Resp=N)
msI4(DF=Y%C=FF%DFE=Y%TOS=C4)

Fingerprint Solaris 2.6/2.7
BaseType Solaris Unix
TSeq(Class=RI%gcd=<4%SI=<FFFF)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(DF=Y%C=FF%DFE=Y%TOS=C4)
msI3(Resp=N)
msI4(DF=Y%C=FF%DFE=Y%TOS=C4)

Fingerprint HP LaserJet 4050 	# 
BaseType 
TSeq(Class=TD%gcd=>FFFF%SI=<6)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=00%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Livingston PortMaster # wtf sort of stack does this?
BaseType 
TSeq(Class=C%Val=&7F)	# stack sucks too much to respond most of the time so often Resp=N		
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 98 v2	# 
BaseType MS Win 9x
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(DF=N%C=%DFE=N%TOS=00)

Fingerprint Windows 95 (ws2) 	# (with Winsock 2)
BaseType MS Win 9x
TSeq(Class=TD%gcd=<6%SI=<1F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 95  	# first release, lower TTL
BaseType MS Win 9x
TSeq(Class=TD%gcd=<6%SI=<1F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint VMS 6.2	# Alpha Hardware
BaseType Digital VMS
TSeq(Class=TR)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(DF=N%C=FF%DFE=Y%TOS=C4)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Windows NT4 sp3
BaseType MS Win NT/2K
TSeq(Class=TD%gcd=1|2|4|A%SI=<2A)		# also gcd=50?
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows NT4 sp6a 
BaseType MS Win NT/2K
TSeq(Class=TD%gcd=1|2|3%SI=<5A)		# IS THIS TOO TIGHT?
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4|00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 2000	# 
BaseType MS Win NT/2K
TSeq(Class=RI%gcd=1|2%SI=<5FFF&>FFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=00)      # TOS=C4 when the EnableUserTOS reg key is set 
#msI1(DF=N%C=00%DFE=Y%TOS=00|C4)  # If you uncomment this you also match ME systems
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=%DFE=N%TOS=00)