That involves checking the window size on returned packets. For many TCP implementations, the initial window size is unique, and it identifies the operating system. For others, it simply narrows the possibilities. ACK value . That involves looking at the sequence value used in the ACK field.
Most implementations return the value sent, while others return the value incremented by one.
ICMP error message quenching That involves narrowing the possible operating systems by determining whether or not they adhere to RFC 1812 guidelines with respect to limiting the rate at which error messages are sent. That process involves sending packets to random high-numbered UDP ports and counting the number of destination unreachable messages returned in a given time period. ICMP message quoting . That involves determining how much information from an ICMP message is returned when an error is generated. Most implementations, for example, send only the required IP header with an additional 8 bytes.