# Mingsweeper 1.00a1 generated IP Stack Fingerprints
# www.hoobie.net/mingsweeper/

DefinedBaseTypes Cisco Router,BSD,Firewall,Linux,Solaris,VMS,Win NT/2K,Win 9x   

Fingerprint AIX 4.1.4	# rs-6000 hardware
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD 2.x
BaseType BSD
TSeq(Class=64K)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD x.x 	# unknown version
BaseType BSD
TSeq(Class=RI%gcd=<3%SI=<DFFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint FreeBSD (i386)	# i386 hardware, unknown version
BaseType BSD
TSeq(Class=RI%gcd=<3%SI=<FFFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=64)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=64)

Fingerprint BSDI 4.0.1
BaseType BSD
TSeq(Class=RI%gcd=<4%SI=>FFF&<12000)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint IRIX # unknown version
BaseType 
TSeq(Class=RI%gcd=20|A0%SI=>A&<FFF)
T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Linux 2.0.34
BaseType Linux
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)	# returns the bogus flag
T2(Resp=N)
T3(DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.0.38	# hoobie
BaseType Linux
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.2.12	# 
BaseType Linux
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.2.16	#  
BaseType Linux
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.2.17	# ninjux
BaseType Linux
TSeq(Class=RI%gcd=<15%SI=>FFFFF)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=00%DFE=N%TOS=C4)

Fingerprint Linux 2.4.3
BaseType Linux
TSeq(Class=RI%gcd=<4%SI=<3FFFFF)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=Y%C=00%DFE=Y%TOS=C4)

Fingerprint Cisco 160x IOS 12.1 	# 
BaseType Cisco Router
TSeq(Class=RI%gcd=<A%SI=<FFFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N%C=%DFE=%TOS=)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco 250x IOS 11.1
BaseType Cisco Router
TSeq(Class=RI%gcd=<6%SI=>A00)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(Resp=N)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Cisco PIX 4.4
BaseType Firewall
TSeq(Class=TR)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMET)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint PIX (?.?) static/conduit?
BaseType Firewall
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=AR%Ops=WNMET)
T4(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=WNMET)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=%DFE=Y%TOS=)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint PIX (?.?) static/conduit?
BaseType Firewall
TSeq(Class=RI%gcd=<3%SI=<1FFFF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMET)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMET)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=AR%Ops=WNMET)
T4(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=WNMET)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)
msIClass(TTL=255)
msI1(DF=N%C=%DFE=Y%TOS=)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Solaris 2.5.1 	
BaseType Solaris
TSeq(Class=RI%gcd=<7%SI=<1FFFF)
T1(DF=Y%W=2332|8377%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(DF=Y%C=FF%DFE=Y%TOS=C4)
msI3(Resp=N)
msI4(DF=Y%C=FF%DFE=Y%TOS=C4)

Fingerprint Solaris 2.6/2.7
BaseType Solaris
TSeq(Class=RI%gcd=<4%SI=<FFFF)
T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=Y%C=FF%DFE=Y%TOS=C4)
msI2(DF=Y%C=FF%DFE=Y%TOS=C4)
msI3(Resp=N)
msI4(DF=Y%C=FF%DFE=Y%TOS=C4)

Fingerprint HP LaserJet 4050 	# 
BaseType 
TSeq(Class=TD%gcd=>FFFF%SI=<6)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=64)
msI1(DF=N%C=00%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Livingston PortMaster # wtf sort of stack does this?
BaseType 
TSeq(Class=C%Val=&7F)	# stack sucks too much to respond most of the time so often Resp=N		
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=N%TOS=00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 98 v2	# 
BaseType Win 9x
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(DF=N%C=%DFE=N%TOS=00)

Fingerprint Windows 95 (ws2) 	# (with Winsock 2)
BaseType Win 9x
TSeq(Class=TD%gcd=<6%SI=<1F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 95  	# first release, lower TTL
BaseType Win 9x
TSeq(Class=TD%gcd=<6%SI=<1F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=32)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint VMS 6.2	# Alpha Hardware
BaseType VMS
TSeq(Class=TR)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
msIClass(TTL=255)
msI1(DF=N%C=FF%DFE=Y%TOS=C4)
msI2(DF=N%C=FF%DFE=Y%TOS=C4)
msI3(DF=N%C=FF%DFE=Y%TOS=C4)
msI4(DF=N%C=FF%DFE=Y%TOS=C4)

Fingerprint Windows NT4 sp3
BaseType Win NT/2K
TSeq(Class=TD%gcd=1|2|4|A%SI=<2A)		# also gcd=50?
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4)
msI2(DF=N%C=00%DFE=N%TOS=00)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows NT4 sp6a 
BaseType Win NT/2K
TSeq(Class=TD%gcd=1|2|3%SI=<5A)		# IS THIS TOO TIGHT?
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=C4|00)
msI2(Resp=N)
msI3(Resp=N)
msI4(Resp=N)

Fingerprint Windows 2000	# 
BaseType Win NT/2K
TSeq(Class=RI%gcd=1|2%SI=<5FFF&>FFF)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
msIClass(TTL=128)
msI1(DF=N%C=00%DFE=Y%TOS=00)      # TOS=C4 when the EnableUserTOS reg key is set 
#msI1(DF=N%C=00%DFE=Y%TOS=00|C4)  # If you uncomment this you also match ME systems
msI2(Resp=N)
msI3(Resp=N)
msI4(DF=N%C=%DFE=N%TOS=00)









