Passive OS Fingerprinting

In Passive fingerprinting we analyze or sniffs the network traffic , rather than generating network traffic by sending packets to them. Hence, it’s a more effective way of avoiding detection or being stopped by a firewall.A simple but effective passive method is to inspect the initial Time To Live (TTL) in the IP header and the TCP window size (the size of the receive window) of the first packet in a TCP session. Below are some typical initial TTL values and window sizes of common operating systems that can be used in order to do manual OS fingerprinting of network traffic