I used time exceeded messages in combination with atomic fragments to get fragmentation ID's from hosts with a (Windows) FW .This script was used for the last fingerprint in my slides