Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.

But what kind of probes would distinguish a Linux system or a Windows system? A Linux 2.4 or 2.6 system? Windows XP or Windows 7 system etc?

share|improve this question
up vote 6 down vote accepted

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon.

From NMap OS Detection:

...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its nmap-os-db database of more than 2,600 known OS fingerprints and prints out the OS details if there is a match

share|improve this answer
The link to the NMAP detection paper does not work anymore. – Jon Oct 16 '14 at 11:13
The section of the Nmap book on OS detection is very good, too: – bonsaiviking Oct 16 '14 at 13:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.