Deleted Added
sdiff udiff text old ( 130151 ) new ( 135183 )
full compact
pf.os (130151) pf.os (135183)
1# $FreeBSD: head/etc/pf.os 130151 2004-06-06 11:46:29Z schweikh $
2# $OpenBSD: pf.os,v 1.10 2003/09/06 01:37:07 frantzen Exp $
1# $FreeBSD: head/etc/pf.os 135183 2004-09-14 00:30:14Z mlaier $
2# $OpenBSD: pf.os,v 1.17 2004/04/28 01:01:27 deraadt Exp $
3# passive OS fingerprinting
4# -------------------------
5#
6# SYN signatures. Those signatures work for SYN packets only (duh!).
7#
8# (C) Copyright 2000-2003 by Michal Zalewski <lcamtuf@coredump.cx>
9# (C) Copyright 2003 by Mike Frantzen <frantzen@w4g.org>
10#

--- 6 unchanged lines hidden (view full) ---

17# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22#
23#
24# This fingerprint database is adapted from Michal Zalewski's p0f passive
3# passive OS fingerprinting
4# -------------------------
5#
6# SYN signatures. Those signatures work for SYN packets only (duh!).
7#
8# (C) Copyright 2000-2003 by Michal Zalewski <lcamtuf@coredump.cx>
9# (C) Copyright 2003 by Mike Frantzen <frantzen@w4g.org>
10#

--- 6 unchanged lines hidden (view full) ---

17# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
18# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
19# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22#
23#
24# This fingerprint database is adapted from Michal Zalewski's p0f passive
25# operating system package.
25# operating system package. The last database sync was from a Nov 3 2003
26# p0f.fp.
26#
27#
28# Each line in this file specifies a single fingerprint. Please read the
29# information below carefully before attempting to append any signatures
30# reported as UNKNOWN to this file to avoid mistakes.
31#
32# We use the following set metrics for fingerprinting:
33#

--- 102 unchanged lines hidden (view full) ---

136#
137# Option block description is a list of comma or space separated
138# options in the order they appear in the packet:
139#
140# N - NOP option
141# Wnnn - window scaling option, value nnn (or * or %nnn)
142# Mnnn - maximum segment size option, value nnn (or * or %nnn)
143# S - selective ACK OK
27#
28#
29# Each line in this file specifies a single fingerprint. Please read the
30# information below carefully before attempting to append any signatures
31# reported as UNKNOWN to this file to avoid mistakes.
32#
33# We use the following set metrics for fingerprinting:
34#

--- 102 unchanged lines hidden (view full) ---

137#
138# Option block description is a list of comma or space separated
139# options in the order they appear in the packet:
140#
141# N - NOP option
142# Wnnn - window scaling option, value nnn (or * or %nnn)
143# Mnnn - maximum segment size option, value nnn (or * or %nnn)
144# S - selective ACK OK
144# T - timestamp
145# T0 - timestamp with a zero value
145# T - timestamp
146# T0 - timestamp with a zero value
146#
147# To denote no TCP options, use a single '.'.
148#
149# Please report any additions to this file, or any inaccuracies or
150# problems spotted, to the maintainers: lcamtuf@coredump.cx,
151# frantzen@openbsd.org and bugs@openbsd.org with a tcpdump packet
152# capture of the relevant SYN packet(s)
153#
147#
148# To denote no TCP options, use a single '.'.
149#
150# Please report any additions to this file, or any inaccuracies or
151# problems spotted, to the maintainers: lcamtuf@coredump.cx,
152# frantzen@openbsd.org and bugs@openbsd.org with a tcpdump packet
153# capture of the relevant SYN packet(s)
154#
155# A test and submission page is available at
156# http://lcamtuf.coredump.cx/p0f-help/
157#
158#
154# WARNING WARNING WARNING
155# -----------------------
156#
157# Do not add a system X as OS Y just because NMAP says so. It is often
158# the case that X is a NAT firewall. While nmap is talking to the
159# device itself, p0f is fingerprinting the guy behind the firewall
160# instead.
161#

--- 26 unchanged lines hidden (view full) ---

188##########################
189
190# ----------------- AIX ---------------------
191
192# AIX is first because its signatures are close to NetBSD, MacOS X and
193# Linux 2.0, but it uses a fairly rare MSSes, at least sometimes...
194# This is a shoddy hack, though.
195
159# WARNING WARNING WARNING
160# -----------------------
161#
162# Do not add a system X as OS Y just because NMAP says so. It is often
163# the case that X is a NAT firewall. While nmap is talking to the
164# device itself, p0f is fingerprinting the guy behind the firewall
165# instead.
166#

--- 26 unchanged lines hidden (view full) ---

193##########################
194
195# ----------------- AIX ---------------------
196
197# AIX is first because its signatures are close to NetBSD, MacOS X and
198# Linux 2.0, but it uses a fairly rare MSSes, at least sometimes...
199# This is a shoddy hack, though.
200
20145046:64:0:44:M*: AIX:4.3::AIX 4.3
19616384:64:0:44:M512: AIX:4.3:2-3:AIX 4.3.2 and earlier
197
19816384:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
19916384:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
20032768:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
20132768:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
20265535:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
20365535:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
20465535:64:0:64:M*,N,W1,N,N,T,N,N,S: AIX:5.3:ML1:AIX 5.3 ML1
205
206# ----------------- Linux -------------------
207
20216384:64:0:44:M512: AIX:4.3:2-3:AIX 4.3.2 and earlier
203
20416384:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
20516384:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
20632768:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
20732768:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
20865535:64:0:60:M512,N,W%2,N,N,T: AIX:4.3:3:AIX 4.3.3-5.2
20965535:64:0:60:M512,N,W%2,N,N,T: AIX:5.1-5.2::AIX 4.3.3-5.2
21065535:64:0:64:M*,N,W1,N,N,T,N,N,S: AIX:5.3:ML1:AIX 5.3 ML1
211
212# ----------------- Linux -------------------
213
214# S1:64:0:44:M*:A: Linux:1.2::Linux 1.2.x (XXX quirks support)
208512:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x
20916384:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x
210
211# Endian snafu! Nelson says "ha-ha":
2122:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x (MkLinux) on Mac
21364:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x (MkLinux) on Mac
214
215
216S4:64:1:60:M1360,S,T,N,W0: Linux:google::Linux (Google crawlbot)
217
218S2:64:1:60:M*,S,T,N,W0: Linux:2.4::Linux 2.4 (big boy)
219S3:64:1:60:M*,S,T,N,W0: Linux:2.4:18-21:Linux 2.4.18 and newer
220S4:64:1:60:M*,S,T,N,W0: Linux:2.4::Linux 2.4/2.6
221S4:64:1:60:M*,S,T,N,W0: Linux:2.6::Linux 2.4/2.6
222
215512:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x
21616384:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x
217
218# Endian snafu! Nelson says "ha-ha":
2192:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x (MkLinux) on Mac
22064:64:0:44:M*: Linux:2.0:3x:Linux 2.0.3x (MkLinux) on Mac
221
222
223S4:64:1:60:M1360,S,T,N,W0: Linux:google::Linux (Google crawlbot)
224
225S2:64:1:60:M*,S,T,N,W0: Linux:2.4::Linux 2.4 (big boy)
226S3:64:1:60:M*,S,T,N,W0: Linux:2.4:18-21:Linux 2.4.18 and newer
227S4:64:1:60:M*,S,T,N,W0: Linux:2.4::Linux 2.4/2.6
228S4:64:1:60:M*,S,T,N,W0: Linux:2.6::Linux 2.4/2.6
229
223S3:64:1:60:M*,S,T,N,W1: Linux:2.5::Linux 2.5
230S3:64:1:60:M*,S,T,N,W1: Linux:2.5::Linux 2.5 (sometimes 2.4)
224S4:64:1:60:M*,S,T,N,W1: Linux:2.5-2.6::Linux 2.5/2.6
231S4:64:1:60:M*,S,T,N,W1: Linux:2.5-2.6::Linux 2.5/2.6
232S3:64:1:60:M*,S,T,N,W2: Linux:2.5::Linux 2.5 (sometimes 2.4)
233S4:64:1:60:M*,S,T,N,W2: Linux:2.5::Linux 2.5 (sometimes 2.4)
225
226S20:64:1:60:M*,S,T,N,W0: Linux:2.2:20-25:Linux 2.2.20 and newer
227S22:64:1:60:M*,S,T,N,W0: Linux:2.2::Linux 2.2
228S11:64:1:60:M*,S,T,N,W0: Linux:2.2::Linux 2.2
229
230# Popular cluster config scripts disable timestamps and
231# selective ACK:
232S4:64:1:48:M1460,N,W0: Linux:2.4:cluster:Linux 2.4 in cluster

--- 30 unchanged lines hidden (view full) ---

263
26432768:64:1:60:M*,N,W0,N,N,T: FreeBSD:4.8-4.9::FreeBSD 4.8-5.1 (or MacOS X)
26532768:64:1:60:M*,N,W0,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.8-5.1 (or MacOS X)
26665535:64:1:60:M*,N,W0,N,N,T: FreeBSD:4.8-4.9::FreeBSD 4.8-5.1 (or MacOS X)
26765535:64:1:60:M*,N,W0,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.8-5.1 (or MacOS X)
26865535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-4.9::FreeBSD 4.7-5.1
26965535:64:1:60:M*,N,W1,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.7-5.1
270
234
235S20:64:1:60:M*,S,T,N,W0: Linux:2.2:20-25:Linux 2.2.20 and newer
236S22:64:1:60:M*,S,T,N,W0: Linux:2.2::Linux 2.2
237S11:64:1:60:M*,S,T,N,W0: Linux:2.2::Linux 2.2
238
239# Popular cluster config scripts disable timestamps and
240# selective ACK:
241S4:64:1:48:M1460,N,W0: Linux:2.4:cluster:Linux 2.4 in cluster

--- 30 unchanged lines hidden (view full) ---

272
27332768:64:1:60:M*,N,W0,N,N,T: FreeBSD:4.8-4.9::FreeBSD 4.8-5.1 (or MacOS X)
27432768:64:1:60:M*,N,W0,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.8-5.1 (or MacOS X)
27565535:64:1:60:M*,N,W0,N,N,T: FreeBSD:4.8-4.9::FreeBSD 4.8-5.1 (or MacOS X)
27665535:64:1:60:M*,N,W0,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.8-5.1 (or MacOS X)
27765535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-4.9::FreeBSD 4.7-5.1
27865535:64:1:60:M*,N,W1,N,N,T: FreeBSD:5.0-5.1::FreeBSD 4.7-5.1
279
280# XXX need quirks support
281# 65535:64:1:60:M*,N,W0,N,N,T:Z:FreeBSD:5.1-current (1)
282# 65535:64:1:60:M*,N,W1,N,N,T:Z:FreeBSD:5.1-current (2)
283# 65535:64:1:60:M*,N,W2,N,N,T:Z:FreeBSD:5.1-current (3)
284
271# 16384:64:1:60:M*,N,N,N,N,N,N,T:FreeBSD:4.4:noTS:FreeBSD 4.4 (w/o timestamps)
272
273# ----------------- NetBSD ------------------
274
285# 16384:64:1:60:M*,N,N,N,N,N,N,T:FreeBSD:4.4:noTS:FreeBSD 4.4 (w/o timestamps)
286
287# ----------------- NetBSD ------------------
288
28916384:64:0:60:M*,N,W0,N,N,T: NetBSD:1.3::NetBSD 1.3
27565535:64:0:60:M*,N,W0,N,N,T0: NetBSD:1.6:opera:NetBSD 1.6 (Opera)
27616384:64:0:60:M*,N,W0,N,N,T0: NetBSD:1.6::NetBSD 1.6
27716384:64:1:60:M*,N,W0,N,N,T0: NetBSD:1.6:df:NetBSD 1.6 (DF)
29065535:64:0:60:M*,N,W0,N,N,T0: NetBSD:1.6:opera:NetBSD 1.6 (Opera)
29116384:64:0:60:M*,N,W0,N,N,T0: NetBSD:1.6::NetBSD 1.6
29216384:64:1:60:M*,N,W0,N,N,T0: NetBSD:1.6:df:NetBSD 1.6 (DF)
27816384:64:0:60:M*,N,W0,N,N,T: NetBSD:1.3::NetBSD 1.3
27965535:64:1:60:M*,N,W1,N,N,T0: NetBSD:1.6::NetBSD 1.6W-current (DF)
29365535:64:1:60:M*,N,W1,N,N,T0: NetBSD:1.6::NetBSD 1.6W-current (DF)
29465535:64:1:60:M*,N,W0,N,N,T0: NetBSD:1.6::NetBSD 1.6X (DF)
29532768:64:1:60:M*,N,W0,N,N,T0: NetBSD:1.6:randomization:NetBSD 1.6ZH-current (w/ ip_id randomization)
280
281# ----------------- OpenBSD -----------------
282
28316384:64:0:60:M*,N,W0,N,N,T: OpenBSD:2.6::NetBSD 1.3 (or OpenBSD 2.6)
296
297# ----------------- OpenBSD -----------------
298
29916384:64:0:60:M*,N,W0,N,N,T: OpenBSD:2.6::NetBSD 1.3 (or OpenBSD 2.6)
28416384:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.4::OpenBSD 3.0-3.4
28516384:64:0:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.4:no-df:OpenBSD 3.0-3.4 (scrub no-df)
28657344:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.3-3.4::OpenBSD 3.3-3.4
28757344:64:0:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.3-3.4:no-df:OpenBSD 3.3-3.4 (scrub no-df)
30016384:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.5::OpenBSD 3.0-3.5
30116384:64:0:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.5:no-df:OpenBSD 3.0-3.5 (scrub no-df)
30257344:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.3-3.5::OpenBSD 3.3-3.5
30357344:64:0:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.3-3.5:no-df:OpenBSD 3.3-3.5 (scrub no-df)
288
304
28965535:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.4:opera:OpenBSD 3.0-3.4 (Opera)
30565535:64:1:64:M*,N,N,S,N,W0,N,N,T: OpenBSD:3.0-3.5:opera:OpenBSD 3.0-3.5 (Opera)
290
291# ----------------- Solaris -----------------
292
293S17:64:1:64:N,W3,N,N,T0,N,N,S,M*: Solaris:8:RFC1323:Solaris 8 RFC1323
294S17:64:1:48:N,N,S,M*: Solaris:8::Solaris 8
295S17:255:1:44:M*: Solaris:2.5-2.7::Solaris 2.5 to 7
296
297S6:255:1:44:M*: Solaris:2.6-2.7::Solaris 2.6 to 7
298S23:255:1:44:M*: Solaris:2.5:1:Solaris 2.5.1
299S34:64:1:48:M*,N,N,S: Solaris:2.9::Solaris 9
300S44:255:1:44:M*: Solaris:2.7::Solaris 7
301
306
307# ----------------- Solaris -----------------
308
309S17:64:1:64:N,W3,N,N,T0,N,N,S,M*: Solaris:8:RFC1323:Solaris 8 RFC1323
310S17:64:1:48:N,N,S,M*: Solaris:8::Solaris 8
311S17:255:1:44:M*: Solaris:2.5-2.7::Solaris 2.5 to 7
312
313S6:255:1:44:M*: Solaris:2.6-2.7::Solaris 2.6 to 7
314S23:255:1:44:M*: Solaris:2.5:1:Solaris 2.5.1
315S34:64:1:48:M*,N,N,S: Solaris:2.9::Solaris 9
316S44:255:1:44:M*: Solaris:2.7::Solaris 7
317
3184096:64:0:44:M1460: SunOS:4.1::SunOS 4.1.x
319
320S34:64:1:52:M*,N,W0,N,N,S: Solaris:10::Solaris 10 (beta)
321
302# ----------------- IRIX --------------------
303
30449152:64:0:44:M*: IRIX:6.4::IRIX 6.4
30561440:64:0:44:M*: IRIX:6.2-6.5::IRIX 6.2-6.5
30649152:64:0:52:M*,N,W2,N,N,S: IRIX:6.5:RFC1323:IRIX 6.5 (RFC1323)
30749152:64:0:52:M*,N,W3,N,N,S: IRIX:6.5:RFC1323:IRIX 6.5 (RFC1323)
308
30961440:64:0:48:M*,N,N,S: IRIX:6.5:12-21:IRIX 6.5.12 - 6.5.21
31049152:64:0:48:M*,N,N,S: IRIX:6.5:15-21:IRIX 6.5.15 - 6.5.21
311
312# ----------------- Tru64 -------------------
313
322# ----------------- IRIX --------------------
323
32449152:64:0:44:M*: IRIX:6.4::IRIX 6.4
32561440:64:0:44:M*: IRIX:6.2-6.5::IRIX 6.2-6.5
32649152:64:0:52:M*,N,W2,N,N,S: IRIX:6.5:RFC1323:IRIX 6.5 (RFC1323)
32749152:64:0:52:M*,N,W3,N,N,S: IRIX:6.5:RFC1323:IRIX 6.5 (RFC1323)
328
32961440:64:0:48:M*,N,N,S: IRIX:6.5:12-21:IRIX 6.5.12 - 6.5.21
33049152:64:0:48:M*,N,N,S: IRIX:6.5:15-21:IRIX 6.5.15 - 6.5.21
331
332# ----------------- Tru64 -------------------
333
31432768:64:1:48:M*,N,W0: Tru64:4.0::Tru64 4.0
33432768:64:1:48:M*,N,W0: Tru64:4.0::Tru64 4.0 (or OS/2 Warp 4)
31532768:64:0:48:M*,N,W0: Tru64:5.0::Tru64 5.0
3168192:64:0:44:M1460: Tru64:5.1:noRFC1323:Tru64 6.1 (no RFC1323) (or QNX 6)
33532768:64:0:48:M*,N,W0: Tru64:5.0::Tru64 5.0
3368192:64:0:44:M1460: Tru64:5.1:noRFC1323:Tru64 6.1 (no RFC1323) (or QNX 6)
317
318# This looks awfully Linuxish :/
319# S22:64:0:60:M*,S,T,N,W0: Tru64:5.0:a:Tru64 5.0a
320
32161440:64:0:48:M*,N,W0: Tru64:5.1a:JP4:Tru64 v5.1a JP4 (or OpenVMS 7.x on Compaq 5.x stack)
322
33761440:64:0:48:M*,N,W0: Tru64:5.1a:JP4:Tru64 v5.1a JP4 (or OpenVMS 7.x on Compaq 5.x stack)
338
323
324# ----------------- OpenVMS -----------------
325
3266144:64:1:60:M*,N,W0,N,N,T: OpenVMS:7.2::OpenVMS 7.2 (Multinet 4.4 stack)
327
328# ----------------- MacOS -------------------
329
339# ----------------- OpenVMS -----------------
340
3416144:64:1:60:M*,N,W0,N,N,T: OpenVMS:7.2::OpenVMS 7.2 (Multinet 4.4 stack)
342
343# ----------------- MacOS -------------------
344
345# XXX Need EOL tcp opt support
346# S2:255:1:48:M*,W0,E:.:MacOS:8.6 classic
347
348# XXX some of these use EOL too
33016616:255:1:48:M*,W0: MacOS:7.3-7.6:OTTCP:MacOS 7.3-8.6 (OTTCP)
33116616:255:1:48:M*,W0: MacOS:8.0-8.6:OTTCP:MacOS 7.3-8.6 (OTTCP)
34916616:255:1:48:M*,W0: MacOS:7.3-7.6:OTTCP:MacOS 7.3-8.6 (OTTCP)
35016616:255:1:48:M*,W0: MacOS:8.0-8.6:OTTCP:MacOS 7.3-8.6 (OTTCP)
33232768:255:1:48:M*,W0,N: MacOS:9.1-9.2::MacOS 9.1/9.2
33332768:64:0:60:M*,N,W0,N,N,T: MacOS:X:10.2:MacOS X 10.2
35116616:255:1:48:M*,N,N,N: MacOS:8.1-8.6:OTTCP:MacOS 8.1-8.6 (OTTCP)
35232768:255:1:48:M*,W0,N: MacOS:9.0-9.2::MacOS 9.0-9.2
35365535:255:1:48:M*,N,N,N,N: MacOS:9.1::MacOS 9.1 (OT 2.7.4)
334
354
355
335# ----------------- Windows -----------------
336
356# ----------------- Windows -----------------
357
337# Windows 95 - need more:
358# Windows TCP/IP stack is a mess. For most recent XP, 2000 and
359# even 98, the pathlevel, not the actual OS version, is more
360# relevant to the signature. They share the same code, so it would
361# seem. Luckily for us, almost all Windows 9x boxes have an
362# awkward MSS of 536, which I use to tell one from another
363# in most difficult cases.
338
364
3398192:32:1:44:M*: Windows:95::Windows 95 (low TTL)
3658192:32:1:44:M*: Windows:3.11::Windows 3.11 (Tucows)
366S44:64:1:64:M*,N,W0,N,N,T0,N,N,S: Windows:95::Windows 95
3678192:128:1:64:M*,N,W0,N,N,T0,N,N,S: Windows:95:b:Windows 95b
340
368
341# Windows 98 - plenty of silly signatures:
342S44:32:1:48:M*,N,N,S: Windows:98::Windows 98 (low TTL)
3438192:32:1:48:M*,N,N,S: Windows:98::Windows 98 (low TTL)
369# There were so many tweaking tools and so many stack versions for
370# Windows 98 it is no longer possible to tell them from each other
371# without some very serious research. Until then, there's an insane
372# number of signatures, for your amusement:
344
373
345%8192:64:1:48:M*,N,N,S: Windows:98::Windows 98 (or newer XP/2000 with tweaked TTL)
374S44:32:1:48:M*,N,N,S: Windows:98:lowTTL:Windows 98 (low TTL)
3758192:32:1:48:M*,N,N,S: Windows:98:lowTTL:Windows 98 (low TTL)
376%8192:64:1:48:M536,N,N,S: Windows:98::Windows 98
377%8192:128:1:48:M536,N,N,S: Windows:98::Windows 98
346S4:64:1:48:M*,N,N,S: Windows:98::Windows 98
347S6:64:1:48:M*,N,N,S: Windows:98::Windows 98
348S12:64:1:48:M*,N,N,S: Windows:98::Windows 98
378S4:64:1:48:M*,N,N,S: Windows:98::Windows 98
379S6:64:1:48:M*,N,N,S: Windows:98::Windows 98
380S12:64:1:48:M*,N,N,S: Windows:98::Windows 98
381T30:64:1:64:M1460,N,W0,N,N,T0,N,N,S: Windows:98::Windows 98
34932767:64:1:48:M*,N,N,S: Windows:98::Windows 98
35037300:64:1:48:M*,N,N,S: Windows:98::Windows 98
35146080:64:1:52:M*,N,W3,N,N,S: Windows:98:RFC1323:Windows 98 (RFC1323)
38232767:64:1:48:M*,N,N,S: Windows:98::Windows 98
38337300:64:1:48:M*,N,N,S: Windows:98::Windows 98
38446080:64:1:52:M*,N,W3,N,N,S: Windows:98:RFC1323:Windows 98 (RFC1323)
35265535:64:1:44:M*: Windows:98:noSACK:Windows 98 (no sack)
353
38565535:64:1:44:M*: Windows:98:noSack:Windows 98 (no sack)
354S16:128:1:48:M*,N,N,S: Windows:98::Windows 98
355S16:128:1:64:M*,N,W0,N,N,T0,N,N,S: Windows:98::Windows 98
356S26:128:1:48:M*,N,N,S: Windows:98::Windows 98
357T30:128:1:48:M*,N,N,S: Windows:98::Windows 98
35832767:128:1:52:M*,N,W0,N,N,S: Windows:98::Windows 98
35960352:128:1:48:M*,N,N,S: Windows:98::Windows 98
36060352:128:1:64:M*,N,W2,N,N,T0,N,N,S: Windows:98::Windows 98
361
386S16:128:1:48:M*,N,N,S: Windows:98::Windows 98
387S16:128:1:64:M*,N,W0,N,N,T0,N,N,S: Windows:98::Windows 98
388S26:128:1:48:M*,N,N,S: Windows:98::Windows 98
389T30:128:1:48:M*,N,N,S: Windows:98::Windows 98
39032767:128:1:52:M*,N,W0,N,N,S: Windows:98::Windows 98
39160352:128:1:48:M*,N,N,S: Windows:98::Windows 98
39260352:128:1:64:M*,N,W2,N,N,T0,N,N,S: Windows:98::Windows 98
393
362# Windows NT 4.0 - need more:
363
394# What's with 1414 on NT?
395T31:128:1:44:M1414: Windows:NT:4.0:Windows NT 4.0 SP6a
36464512:128:1:44:M1414: Windows:NT:4.0:Windows NT 4.0 SP6a
3658192:128:1:44:M*: Windows:NT:4.0:Windows NT 4.0 (older)
39664512:128:1:44:M1414: Windows:NT:4.0:Windows NT 4.0 SP6a
3978192:128:1:44:M*: Windows:NT:4.0:Windows NT 4.0 (older)
3666144:128:1:52:M*,W0,N,S,N,N: Windows:NT:4.0:Windows NT 4.0 (RFC1323)
367
368# Windows XP and 2000. Most of the signatures that were
369# either dubious or non-specific (no service pack data)
370# were deleted and replaced with generics at the end.
371
37265535:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1
398
399# Windows XP and 2000. Most of the signatures that were
400# either dubious or non-specific (no service pack data)
401# were deleted and replaced with generics at the end.
402
40365535:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1
373%8192:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1
374S45:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4
375S6:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows XP SP1, 2000 SP4
376S44:128:1:48:M*,N,N,S: Windows:2000:SP3:Windows XP Pro SP1, 2000 SP3
377
378S6:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows XP SP1, 2000 SP4
379S44:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows XP Pro SP1, 2000 SP3
38064512:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows XP SP1
38132767:128:1:48:M1452,N,N,S: Windows:XP:SP1:Windows XP SP1
38265535:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows 2000 SP4, XP SP1
40465535:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows 2000 SP4, XP SP1
383%8192:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows 2000 SP4, XP SP1
405%8192:128:1:48:M*,N,N,S: Windows:2000:SP2+:Windows 2000 SP2, XP SP1 (seldom 98 4.10.2222)
406%8192:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows 2000 SP2, XP SP1 (seldom 98 4.10.2222)
407S20:128:1:48:M*,N,N,S: Windows:2000::Windows 2000/XP SP3
408S20:128:1:48:M*,N,N,S: Windows:XP:SP3:Windows 2000/XP SP3
409S45:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP 1
410S45:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows 2000 SP4, XP SP 1
41140320:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4
384
412
413S6:128:1:48:M*,N,N,S: Windows:2000:SP2:Windows XP, 2000 SP2+
414S6:128:1:48:M*,N,N,S: Windows:XP::Windows XP, 2000 SP2+
415S12:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows XP SP1
416S44:128:1:48:M*,N,N,S: Windows:2000:SP3:Windows Pro SP1, 2000 SP3
417S44:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows Pro SP1, 2000 SP3
41864512:128:1:48:M*,N,N,S: Windows:2000:SP3:Windows SP1, 2000 SP3
41964512:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows SP1, 2000 SP3
42032767:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows SP1, 2000 SP4
42132767:128:1:48:M*,N,N,S: Windows:XP:SP1:Windows SP1, 2000 SP4
422
385# Odds, ends, mods:
386
423# Odds, ends, mods:
424
387S52:128:1:48:M1260,N,N,S: Windows:XP:Cisco:Windows XP/2000 via Cisco
388S52:128:1:48:M1260,N,N,S: Windows:2000:Cisco:Windows XP/2000 via Cisco
425S52:128:1:48:M1260,N,N,S: Windows:2000:cisco:Windows XP/2000 via Cisco
426S52:128:1:48:M1260,N,N,S: Windows:XP:cisco:Windows XP/2000 via Cisco
42765520:128:1:48:M*,N,N,S: Windows:XP::Windows XP bare-bone
42816384:128:1:52:M536,N,W0,N,N,S: Windows:2000:ZoneAlarm:Windows 2000 w/ZoneAlarm?
4292048:255:0:40:.: Windows:.NET::Windows .NET Enterprise Server
389
430
390# HUNT DOWN:
391# *:128:1:48:M*,N,N,S:U:@Windows:XP (leak) (PLEASE REPORT)
431# No need to be more specific, it passes:
432# *:128:1:48:M*,N,N,S:U:-Windows:XP/2000 while downloading (leak!) XXX quirk
433# there is an equiv similar generic sig w/o the quirk
392
393# ----------------- HP/UX -------------------
394
39532768:64:1:44:M*: HP-UX:B.10.20::HP-UX B.10.20
39632768:64:0:48:M*,W0,N: HP-UX:11.0::HP-UX 11.0
39732768:64:1:48:M*,W0,N: HP-UX:11.10::HP-UX 11.0 or 11.11
39832768:64:1:48:M*,W0,N: HP-UX:11.11::HP-UX 11.0 or 11.11
399
400# Whoa. Hardcore WSS.
4010:64:0:48:M*,W0,N: HP-UX:B.11.00:A:HP-UX B.11.00 A (RFC1323)
402
403
404# ----------------- RiscOS ------------------
405
406# We don't yet support the ?12 TCP option
407#16384:64:1:68:M1460,N,W0,N,N,T,N,N,?12: RISCOS:3.70-4.36::RISC OS 3.70-4.36
434
435# ----------------- HP/UX -------------------
436
43732768:64:1:44:M*: HP-UX:B.10.20::HP-UX B.10.20
43832768:64:0:48:M*,W0,N: HP-UX:11.0::HP-UX 11.0
43932768:64:1:48:M*,W0,N: HP-UX:11.10::HP-UX 11.0 or 11.11
44032768:64:1:48:M*,W0,N: HP-UX:11.11::HP-UX 11.0 or 11.11
441
442# Whoa. Hardcore WSS.
4430:64:0:48:M*,W0,N: HP-UX:B.11.00:A:HP-UX B.11.00 A (RFC1323)
444
445
446# ----------------- RiscOS ------------------
447
448# We don't yet support the ?12 TCP option
449#16384:64:1:68:M1460,N,W0,N,N,T,N,N,?12: RISCOS:3.70-4.36::RISC OS 3.70-4.36
45012288:32:0:44:M536: RISC OS:3.70:4.10:RISC OS 3.70 inet 4.10
408
451
452# XXX quirk
453# 4096:64:1:56:M1460,N,N,T:T: RISC OS:3.70:freenet:RISC OS 3.70 freenet 2.00
454
455
409# ----------------- BSD/OS ------------------
410
411# Once again, power of two WSS is also shared by MacOS X with DF set
4128192:64:1:60:M1460,N,W0,N,N,T: BSD/OS:3.1::BSD/OS 3.1-4.3 (or MacOS X 10.2 w/DF)
4138192:64:1:60:M1460,N,W0,N,N,T: BSD/OS:4.0-4.3::BSD/OS 3.1-4.3 (or MacOS X 10.2)
414
415
416# ---------------- NewtonOS -----------------

--- 10 unchanged lines hidden (view full) ---

42712288:255:0:44:M1402: BeOS:5.0::BeOS 5.0.x
428
429# ------------------ OS/400 -----------------
430
4318192:64:1:60:M1440,N,W0,N,N,T: OS/400:VR4::OS/400 VR4/R5
4328192:64:1:60:M1440,N,W0,N,N,T: OS/400:VR5::OS/400 VR4/R5
4334096:64:1:60:M1440,N,W0,N,N,T: OS/400:V4R5:CF67032:OS/400 V4R5 + CF67032
434
456# ----------------- BSD/OS ------------------
457
458# Once again, power of two WSS is also shared by MacOS X with DF set
4598192:64:1:60:M1460,N,W0,N,N,T: BSD/OS:3.1::BSD/OS 3.1-4.3 (or MacOS X 10.2 w/DF)
4608192:64:1:60:M1460,N,W0,N,N,T: BSD/OS:4.0-4.3::BSD/OS 3.1-4.3 (or MacOS X 10.2)
461
462
463# ---------------- NewtonOS -----------------

--- 10 unchanged lines hidden (view full) ---

47412288:255:0:44:M1402: BeOS:5.0::BeOS 5.0.x
475
476# ------------------ OS/400 -----------------
477
4788192:64:1:60:M1440,N,W0,N,N,T: OS/400:VR4::OS/400 VR4/R5
4798192:64:1:60:M1440,N,W0,N,N,T: OS/400:VR5::OS/400 VR4/R5
4804096:64:1:60:M1440,N,W0,N,N,T: OS/400:V4R5:CF67032:OS/400 V4R5 + CF67032
481
482# XXX quirk
483# 28672:64:0:44:M1460:A:OS/390:?
435
436# ------------------ ULTRIX -----------------
437
43816384:64:0:40:.: ULTRIX:4.5::ULTRIX 4.5
439
440# ------------------- QNX -------------------
441
442S16:64:0:44:M512: QNX:::QNX demodisk
443
444# ------------------ Novell -----------------
445
44616384:128:1:44:M1460: Novell:NetWare:5.0:Novel Netware 5.0
4476144:128:1:44:M1460: Novell:IntranetWare:4.11:Novell IntranetWare 4.11
484
485# ------------------ ULTRIX -----------------
486
48716384:64:0:40:.: ULTRIX:4.5::ULTRIX 4.5
488
489# ------------------- QNX -------------------
490
491S16:64:0:44:M512: QNX:::QNX demodisk
492
493# ------------------ Novell -----------------
494
49516384:128:1:44:M1460: Novell:NetWare:5.0:Novel Netware 5.0
4966144:128:1:44:M1460: Novell:IntranetWare:4.11:Novell IntranetWare 4.11
4976144:128:1:44:M1368: Novell:BorderManager::Novell BorderManager ?
448
498
4996144:128:1:52:M*,W0,N,S,N,N: Novell:Netware:6:Novell Netware 6 SP3
500
501
449# ----------------- SCO ------------------
502# ----------------- SCO ------------------
450S17:64:1:44:M1460: SCO:Unixware:7.0:SCO Unixware 7.0.0 or OpenServer 5.0.4-5.06
451S17:64:1:44:M1460: SCO:OpenServer:5.0:SCO Unixware 7.0.0 or OpenServer 5.0.4-5.06
452S3:64:1:60:M1460,N,W0,N,N,T: SCO:UnixWare:7.1:SCO UnixWare 7.1
503S3:64:1:60:M1460,N,W0,N,N,T: SCO:UnixWare:7.1:SCO UnixWare 7.1
504S23:64:1:44:M1380: SCO:OpenServer:5.0:SCO OpenServer 5.0
453
454# ------------------- DOS -------------------
455
4562048:255:0:44:M536: DOS:WATTCP:1.05:DOS Arachne via WATTCP/1.05
457
505
506# ------------------- DOS -------------------
507
5082048:255:0:44:M536: DOS:WATTCP:1.05:DOS Arachne via WATTCP/1.05
509
510# ------------------ OS/2 -------------------
511
512S56:64:0:44:M512: OS/2:4::OS/2 4
513
514# ----------------- TOPS-20 -----------------
515
516# Another hardcore MSS, one of the ACK leakers hunted down.
517# XXX QUIRK 0:64:0:44:M1460:A:TOPS-20:version 7
5180:64:0:44:M1460: TOPS-20:7::TOPS-20 version 7
519
520# ------------------ AMIGA ------------------
521
522# XXX TCP option 12
523# S32:64:1:56:M*,N,N,S,N,N,?12:.:AMIGA:3.9 BB2 with Miami stack
524
525# ------------------ Plan9 ------------------
526
52765535:255:0:48:M1460,W0,N: Plan9:4::Plan9 edition 4
528
529# ----------------- AMIGAOS -----------------
530
53116384:64:1:48:M1560,N,N,S: AMIGAOS:3.9::AMIGAOS 3.9 BB2 MiamiDX
532
458###########################################
459# Appliance / embedded / other signatures #
460###########################################
461
462# ---------- Firewalls / routers ------------
463
464S12:64:1:44:M1460: @Checkpoint:::Checkpoint (unknown 1)
465S12:64:1:48:N,N,S,M1460: @Checkpoint:::Checkpoint (unknown 2)
4664096:32:0:44:M1460: ExtremeWare:4.x::ExtremeWare 4.x
46760352:64:0:52:M1460,N,W2,N,N,S: Clavister:7::Clavister firewall 7.x
468
533###########################################
534# Appliance / embedded / other signatures #
535###########################################
536
537# ---------- Firewalls / routers ------------
538
539S12:64:1:44:M1460: @Checkpoint:::Checkpoint (unknown 1)
540S12:64:1:48:N,N,S,M1460: @Checkpoint:::Checkpoint (unknown 2)
5414096:32:0:44:M1460: ExtremeWare:4.x::ExtremeWare 4.x
54260352:64:0:52:M1460,N,W2,N,N,S: Clavister:7::Clavister firewall 7.x
543
544# XXX TCP option 12
545# S32:64:0:68:M512,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO w/Checkpoint NG FP3
546# S16:64:0:68:M1024,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO 3.7 build 026
547
548S4:64:1:60:W0,N,S,T,M1460: FortiNet:FortiGate:50:FortiNet FortiGate 50
549
5508192:64:1:44:M1460: Eagle:::Eagle Secure Gateway
551
552
469# ------- Switches and other stuff ----------
470
4714128:255:0:44:M*: Cisco:::Cisco Catalyst 3500, 7500 etc
472S8:255:0:44:M*: Cisco:12008::Cisco 12008
47360352:128:1:64:M1460,N,W2,N,N,T,N,N,S: Alteon:ACEswitch::Alteon ACEswitch
47464512:128:1:44:M1370: Nortel:Contivity Client::Nortel Conectivity Client
475
476
477# ---------- Caches and whatnots ------------
478
479S4:64:1:52:M1460,N,N,S,N,W0: AOL:web cache::AOL web cache
480
48132850:64:1:64:N,W1,N,N,T,N,N,S,M*: NetApp:5.x::NetApp Data OnTap 5.x
48216384:64:1:64:M1460,N,N,S,N,W0,N: NetApp:5.3:1:NetApp 5.3.1
553# ------- Switches and other stuff ----------
554
5554128:255:0:44:M*: Cisco:::Cisco Catalyst 3500, 7500 etc
556S8:255:0:44:M*: Cisco:12008::Cisco 12008
55760352:128:1:64:M1460,N,W2,N,N,T,N,N,S: Alteon:ACEswitch::Alteon ACEswitch
55864512:128:1:44:M1370: Nortel:Contivity Client::Nortel Conectivity Client
559
560
561# ---------- Caches and whatnots ------------
562
563S4:64:1:52:M1460,N,N,S,N,W0: AOL:web cache::AOL web cache
564
56532850:64:1:64:N,W1,N,N,T,N,N,S,M*: NetApp:5.x::NetApp Data OnTap 5.x
56616384:64:1:64:M1460,N,N,S,N,W0,N: NetApp:5.3:1:NetApp 5.3.1
48365535:64:0:64:M1460,N,N,S,N,W3,N,N,T: NetApp:5.3:1:NetApp 5.3.1
56765535:64:0:64:M1460,N,N,S,N,W*,N,N,T: NetApp:5.3-5.5::NetApp 5.3-5.5
48465535:64:0:60:M1460,N,W0,N,N,T: NetApp:CacheFlow::NetApp CacheFlow
4858192:64:1:64:M1460,N,N,S,N,W0,N,N,T: NetApp:5.2:1:NetApp NetCache 5.2.1
56865535:64:0:60:M1460,N,W0,N,N,T: NetApp:CacheFlow::NetApp CacheFlow
5698192:64:1:64:M1460,N,N,S,N,W0,N,N,T: NetApp:5.2:1:NetApp NetCache 5.2.1
57020480:64:1:64:M1460,N,N,S,N,W0,N,N,T: NetApp:4.1::NetApp NetCache4.1
486
571
57265535:64:0:60:M1460,N,W0,N,N,T: CacheFlow:4.1::CacheFlow CacheOS 4.1
5738192:64:0:60:M1380,N,N,N,N,N,N,T: CacheFlow:1.1::CacheFlow CacheOS 1.1
574
487S4:64:0:48:M1460,N,N,S: Cisco:Content Engine::Cisco Content Engine
488
48927085:128:0:40:.: Dell:PowerApp cache::Dell PowerApp (Linux-based)
490
49165535:255:1:48:N,W1,M1460: Inktomi:crawler::Inktomi crawler
492S1:255:1:60:M1460,S,T,N,W0: LookSmart:ZyBorg::LookSmart ZyBorg
493
575S4:64:0:48:M1460,N,N,S: Cisco:Content Engine::Cisco Content Engine
576
57727085:128:0:40:.: Dell:PowerApp cache::Dell PowerApp (Linux-based)
578
57965535:255:1:48:N,W1,M1460: Inktomi:crawler::Inktomi crawler
580S1:255:1:60:M1460,S,T,N,W0: LookSmart:ZyBorg::LookSmart ZyBorg
581
494
49516384:255:0:40:.: Proxyblocker:::Proxyblocker (what's this?)
496
497# ----------- Embedded systems --------------
498
499S9:255:0:44:M536: PalmOS:Tungsten:C:PalmOS Tungsten C
500S5:255:0:44:M536: PalmOS:3::PalmOS 3/4
501S5:255:0:44:M536: PalmOS:4::PalmOS 3/4
502S4:255:0:44:M536: PalmOS:3:5:PalmOS 3.5
5032948:255:0:44:M536: PalmOS:3:5:PalmOS 3.5.3 (Handera)
58216384:255:0:40:.: Proxyblocker:::Proxyblocker (what's this?)
583
584# ----------- Embedded systems --------------
585
586S9:255:0:44:M536: PalmOS:Tungsten:C:PalmOS Tungsten C
587S5:255:0:44:M536: PalmOS:3::PalmOS 3/4
588S5:255:0:44:M536: PalmOS:4::PalmOS 3/4
589S4:255:0:44:M536: PalmOS:3:5:PalmOS 3.5
5902948:255:0:44:M536: PalmOS:3:5:PalmOS 3.5.3 (Handera)
591S29:255:0:44:M536: PalmOS:5::PalmOS 5.0
504
505S23:64:1:64:N,W1,N,N,T,N,N,S,M1460: SymbianOS:7::SymbianOS 7
5068192:255:0:44:M1460: SymbianOS:6048::SymbianOS 6048 (on Nokia 7650?)
5078192:255:0:44:M536: SymbianOS:::SymbianOS (on Nokia 9210?)
508
509
510# Perhaps S4?
5115840:64:1:60:M1452,S,T,N,W1: Zaurus:3.10::Zaurus 3.10
512
51332768:128:1:64:M1460,N,W0,N,N,T0,N,N,S: PocketPC:2002::PocketPC 2002
514
515S1:255:0:44:M346: Contiki:1.1:rc0:Contiki 1.1-rc0
516
5174096:128:0:44:M1460: Sega:Dreamcast:3.0:Sega Dreamcast Dreamkey 3.0
592
593S23:64:1:64:N,W1,N,N,T,N,N,S,M1460: SymbianOS:7::SymbianOS 7
5948192:255:0:44:M1460: SymbianOS:6048::SymbianOS 6048 (on Nokia 7650?)
5958192:255:0:44:M536: SymbianOS:::SymbianOS (on Nokia 9210?)
596
597
598# Perhaps S4?
5995840:64:1:60:M1452,S,T,N,W1: Zaurus:3.10::Zaurus 3.10
600
60132768:128:1:64:M1460,N,W0,N,N,T0,N,N,S: PocketPC:2002::PocketPC 2002
602
603S1:255:0:44:M346: Contiki:1.1:rc0:Contiki 1.1-rc0
604
6054096:128:0:44:M1460: Sega:Dreamcast:3.0:Sega Dreamcast Dreamkey 3.0
606T5:64:0:44:M536: Sega:Dreamcast:HKT-3020:Sega Dreamcast HKT-3020 (browser disc 51027)
607S22:64:1:44:M1460: Sony:PS2::Sony Playstation 2 (SOCOM?)
518
519S12:64:0:44:M1452: AXIS:5600:v5.64:AXIS Printer Server 5600 v5.64
520
521
522
523####################
524# Fancy signatures #
525####################

--- 15 unchanged lines hidden (view full) ---

541#*:64:1:60:M*,N,W*,N,N,T: @FreeBSD:4.0-4.9::FreeBSD 4.x/5.x
542#*:64:1:60:M*,N,W*,N,N,T: @FreeBSD:5.0-5.1::FreeBSD 4.x/5.x
543
544*:128:1:52:M*,N,W0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323 no tstamp)
545*:128:1:52:M*,N,W0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323 no tstamp)
546*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323)
547*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323)
548*:128:1:64:M*,N,W*,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP (RFC1323, w+)
608
609S12:64:0:44:M1452: AXIS:5600:v5.64:AXIS Printer Server 5600 v5.64
610
611
612
613####################
614# Fancy signatures #
615####################

--- 15 unchanged lines hidden (view full) ---

631#*:64:1:60:M*,N,W*,N,N,T: @FreeBSD:4.0-4.9::FreeBSD 4.x/5.x
632#*:64:1:60:M*,N,W*,N,N,T: @FreeBSD:5.0-5.1::FreeBSD 4.x/5.x
633
634*:128:1:52:M*,N,W0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323 no tstamp)
635*:128:1:52:M*,N,W0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323 no tstamp)
636*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323)
637*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323)
638*:128:1:64:M*,N,W*,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP (RFC1323, w+)
639*:128:1:48:M536,N,N,S: @Windows:98::Windows 98
549*:128:1:48:M*,N,N,S: @Windows:XP::Windows XP/2000
550*:128:1:48:M*,N,N,S: @Windows:2000::Windows XP/2000
640*:128:1:48:M*,N,N,S: @Windows:XP::Windows XP/2000
641*:128:1:48:M*,N,N,S: @Windows:2000::Windows XP/2000
642
643