# Nmap OS Fingerprint List. -*- mode: fundamental; -*-# $Id: nmap-os-fingerprints 2839 2005-09-07 08:26:45Z fyodor $ ## Contributions to this database are welcome.  If Nmap obtains a new# fingerprint (and test conditions are favorable), it will print out a# URL you can use to submit the fingerprint.  If Nmap guesses wrong,# please send the full Nmap output and the exact destination host OS# name and version to fyodor@insecure.org .  Thanks!## By submitting fingerprints you are transfering any and all copyright# interest in the data to Fyodor so that he can modify it, relicense it,# incorporate it into programs, etc.## This collection of fingerprint data is (C) 1998-2003 by# Insecure.Com LLC.  This data is available for# free use by open source software under the terms of the GNU General# Public License.  We also license the data to selected# commercial/proprietary vendors under less restrictive terms.# Contact sales@insecure.com for more information.## TEST DESCRIPTION:# Tseq is the TCP sequenceability test# T1 is a SYN packet with a bunch of TCP options to open port# T2 is a NULL packet w/options to open port# T3 is a SYN|FIN|URG|PSH packet w/options to open port# T4 is an ACK to open port w/options# T5 is a SYN to closed port w/options# T6 is an ACK to closed port w/options# T7 is a FIN|PSH|URG to a closed port w/options# PU is a UDP packet to a closed portFingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0Class 2Wire | embedded || WAPTSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)T2(Resp=N)T3(Resp=N)T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)T7(Resp=N)PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)# 3Com Home Connect Cable Modem external with USB - Model 3CR29223Fingerprint 3Com Home Connect Cable ModemClass 3Com | embedded || broadband routerTSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)# 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0Fingerprint 3Com OfficeConnect 812 aDSL routerClass 3Com | embedded || broadband routerTSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)Fingerprint 3Com OfficeConnect Remote 812 aDSL RouterClass 3Com | embedded || broadband routerTSeq(Class=TD%gcd=<C354%SI=<1E)T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(Resp=N)# 3Com Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604Fingerprint 3Com Sharkfin/Tailfin Cable ModemClass 3Com | embedded || broadband routerTSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com Sharkfin/Tailfin Cable ModemClass 3Com | embedded || broadband routerTSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)# US Robotics USR8000 Broadband router, firmware 1.27 patchedFingerprint US Robotics USR8000 Broadband routerClass 3Com | embedded || broadband routerTSeq(Class=RI%gcd=<68%SI=<726%IPID=BI%TS=U)T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)T4(DF=N%W=800|C00|400%ACK=S%Flags=AR%Ops=)T5(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=)T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# 3Com NBX Superstack 3 IP PBX running firmware 4_1_11# 3Com NBX-100 (version R4_1_4) Phone System ProcessorFingerprint 3Com NBX PBXClass 3Com | embedded || PBXTSeq(Class=64K%IPID=I%TS=2HZ)T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)T2(Resp=N)T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)# 3Com AccessBuilder Remote Office 500 with firmware V05.T4NFingerprint 3Com AccessBuilder Remote Office 500 routerClass 3Com | embedded || routerTSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=400%ACK=O%Flags=AS%Ops=ME)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3Class 3Com | embedded || routerTSeq(Class=TD%gcd=3C%SI=<FF)T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(Resp=N)PU(Resp=N)Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1Class 3Com | embedded || routerTSeq(Class=TD%gcd=32|64|96%SI=<FF)T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(Resp=N)PU(Resp=N)Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51Class 3Com | embedded || routerTSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)Class 3Com | embedded || routerTSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)# 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)Fingerprint 3Com Netbuilder Remote Office 222 routerClass 3Com | embedded || routerTSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27Class 3Com | embedded || routerTSeq(Class=TD%gcd=32|64|96%SI=<F)T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)# 3Com OfficeConnect Netbuilder router running 11.4.0.09Fingerprint 3Com OfficeConnect Netbuilder routerClass 3Com | embedded || routerTSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# 3com OfficeConnect Remote 812 ADSL Router (Firmware V1.1.7)Fingerprint 3com OfficeConnect Remote 812 ADSL RouterClass 3Com | embedded || routerTSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00RClass 3Com | embedded || switchTSeq(Class=C|TD%gcd=3D090%SI=0)T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# 3com Switch 7700 firmware v2.01# Huawei S6506R routing switch VRP 3.10 release 1009Fingerprint 3Com 7700/8800 Switch or Huawei S6506R routing switch VRP 3.10Class 3Com | embedded || switchClass Huawei | VRP || switchTSeq(Class=64K%IPID=I%TS=U)T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=1FC4%ACK=O%Flags=A%Ops=)T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)Fingerprint 3Com Access Builder 4000 SwitchClass 3Com | embedded || switchT1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)# 3Com LANplex 6004 Extended Switching Software 7.0Fingerprint 3Com LANplex 6004 switchClass 3Com | embedded || switchTSeq(Class=64K%IPID=I%TS=U)T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)T2(Resp=N)T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)# Switch 1100, 3300Fingerprint 3Com SuperStack II switch (OS v 2.0)Class 3Com | embedded || switchTSeq(Class=C)T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T2(DF=N%W=0%ACK=S%Flags=APR%Ops=)T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38Class 3Com | embedded || switchTSeq(Class=TD%gcd=<68%SI=<3C)T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# 3Com SuperStack II RAS 1500 software version 2.5.0, 159Fingerprint 3Com SuperStack II RAS remote access serverClass 3Com | embedded || terminal serverTSeq(Class=TD%gcd=<320CC%SI=<14%IPID=I%TS=U)T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint 3Com terminal server ESPL CS2100Class 3Com | embedded || terminal serverTSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06# 3Com 11Mpbs Wireless LAN Access Point 8000Fingerprint Datavoice 3Com WAP or TxPORT PRISM T1 CSU/DSUClass 3Com | embedded || WAPClass Datavoice | embedded || CSUDSUTSeq(Class=RI%gcd=<6%SI=>18000)T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)T2(Resp=N)T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)