The accuracy of the quoting of the packet in the ICMP response varies depending on the target stack, and this, too, can be used to identify an operating system. The final stage uses SYN packets to probe for initial sequence numbers. Nmap collects the initial sequence numbers received from the target and looks for a pattern in the way they are incremented. Really old Unix systems still use a constant increment, while newer and more secure systems use a random increment. Anything that tampers with this information will affect that accuracy.
Firewalls do to a greater or lesser extent.
Most stacks permit tuning some of the tested parameters, but only a small portion of them. Packet-filtering firewalls are ineffective. Application gateways running on a firewall prevent nmap from identifying the target, as nmap will be probing the firewall's stack instead. Of course, the best defense is to prevent any scanning from penetrating your network in the first place, and promptly detecting unauthorized scanning when it takes place within the confines of your network. N Rik Farrow is an independent security consultant.