T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9mClass Amiga | AmigaOS || general purposeTSeq(Class=TR%gcd=<6)T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)T2(Resp=N)T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0cClass Amiga | AmigaOS || general purposeTSeq(Class=TR%gcd=<6)T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS AmiTCP/IP 4.3Class Amiga | AmigaOS || general purposeTSeq(Class=64K)T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS AmiTCP/IP Genesis 4.6Class Amiga | AmigaOS || general purposeTSeq(Class=64K)T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS Miami 2.1-3.0Class Amiga | AmigaOS || general purposeTSeq(Class=TR)T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS Miami 3.0Class Amiga | AmigaOS || general purposeTSeq(Class=TR)T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS Miami 3.1-3.2Class Amiga | AmigaOS || general purposeTSeq(Class=TR)T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2BClass Amiga | AmigaOS || general purposeTSeq(Class=TR)T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)Fingerprint APC MasterSwitch Network Power ControllerClass APC | embedded || power-deviceTSeq(Class=TR)T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)T2(Resp=N)T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)Fingerprint APC Network management Card AP9616Class APC | embedded || power-deviceTSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T2(Resp=N)T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# APC AP9617  network management card inside Matrix 5000 UPSFingerprint APC network-enabled UPSClass APC | embedded || power-deviceTSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T2(Resp=N)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=N)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# APC UPS Network Management Card, Model AP9617Fingerprint APC UPS Network Management CardClass APC | embedded || power-deviceTSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T2(Resp=N)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=N)PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)# SmartUPS 3000RM Firmware: 92.14.I# APC PDU AOS v1.1.6Fingerprint APC UPS systemClass APC | embedded || power-deviceTSeq(Class=TD%gcd=<F38C%SI=<DC%IPID=I)T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T2(Resp=N)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=N)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# American Power Conversion / Network Management Card AOS v2.5.3 / Symmetra LX 16000 RM / This is a network management interface on a high end UPSFingerprint APC UPS System network management card (runs AOS v2.5.3)Class APC | embedded || power-deviceTSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T2(Resp=N)T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# American Power Conversion Smart-UPS 3000 RM firmware revision 666.5.I# APC AOS 2.2.7 (on APC AP7901 network management card)# APC UPS - Symmetra 16000 UPS_IDEN# APC AP9617 SmartSlot UPS network management card# APC Network Management Card EX 10/100BaseT (AP9617)# APC Network Management Card AOS v2.2.7 (Rack PDU APP v2.2.0)# APC network mgmt card AP9617Fingerprint APC UPS System network management card (runs AOS)Class APC | embedded || power-deviceTSeq(Class=TD%gcd=<7A124%SI=<1E%IPID=I%TS=1000HZ)T1(DF=Y|N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)T2(Resp=N)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint APC Web/SNMP UPS management cardClass APC | embedded || power-deviceTSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)T2(Resp=N)T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)Fingerprint Apollo Domain/OS SR10.3.5Class Apollo | Domain/OS || general purposeTSeq(Class=RI|TD%gcd=<E%SI=<898%IPID=I%TS=U)T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)Fingerprint Apollo Domain/OS SR10.4Class Apollo | Domain/OS || general purposeTSeq(Class=TD|RI%gcd=<6%SI=<FF)T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=800%ACK=O%Flags=R%Ops=)T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2Class Apple | A/UX || general purposeTSeq(Class=64K)T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)Class Apple | embedded || printerT1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)T5(Resp=N)T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)# Actually it is not constant seq class -- it just seems that way# because it takes so long to incrementFingerprint Apple Color LaserWriter 600 PrinterClass Apple | embedded || printerTSeq(Class=C)T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)T4(DF=N%W=800%ACK=O%Flags=R%Ops=)T5(Resp=N)T6(DF=N%W=800%ACK=O%Flags=R%Ops=)T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint Apple Color LaserWriter 600 PrinterClass Apple | embedded || printerTSeq(Class=C)T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)T5(Resp=N)T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)Fingerprint Apple LaserWriter 12/640 PSClass Apple | embedded || printerTSeq(Class=C%Val=85BD001%IPID=I%TS=U)T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)T2(Resp=N)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T4(DF=N%W=0%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=O%Flags=R%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=O%Flags=R%Ops=)PU(Resp=N)Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 PrinterClass Apple | embedded || printerTSeq(Class=C)T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)PU(Resp=N)# The sequence prediction is never really true random, but sometimes it# has two unique "tracks" which make it look random to nmap.  Here is a# real example:  Sequence numbers: 5576001 25D001 5576001 25D001Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)Class Apple | embedded || printerTSeq(Class=TR|C)T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)PU(Resp=N)# Apple AirPort Extreme Base Station Firmware 5.1.1Fingerprint Apple Airport Extreme Base Station (WAP) or ARRIS Cadant C3 CMTS Cable ModemClass Apple | embedded || WAPClass ARRIS | embedded || broadband routerTSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT)T2(Resp=N)T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT)T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)T6(DF=N%W=0%ACK=O%Flags=R%Ops=)T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)# Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1)# Apple AirPort Express (Apple Base Station V6.0)# OKI Phaser B6300N laser printer# Netgear 7000 Series Managed Switch (GSM7324) (strang ops)# Westel Versalink 327W, Wireless DSL Modem/RouterFingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westel Broadband router)Class Apple | embedded || WAPClass Dell | embedded || storage-miscClass Okidata | embedded || printerClass Westel | embedded || broadband routerTSeq(Class=RI%gcd=<6%SI=<A9830&>1000%TS=2HZ)T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)T2(Resp=N)T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT)T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)