I have been asked to write a small tool that detects the running OS on a victim device.

The tool should be able to fingerprint Linux versus Android versus iOS. Extra credit for version info. It needs to be done through analysing network traffic. Unfortunately, I know nothing about this, or how it works, or even how to get started. I would appreciate a lot if someone could help and give me starter code.

  • 3
    Go look at the nmap source code. – Mark Buffalo Feb 13 '16 at 12:28
  • 1
    If ttl = 64 then it's linux. If ttl = 128, then it's windows. If ttl = 255, then it's a routing device or unix. If port 111 is open, then it's linux or unix. If port 135/139/445 are open, then it's windows. Bear in mind these are all defaults and can be changed. – Lutefisk Feb 13 '16 at 13:45
  • forgot to mention iOS is also 255 – Lutefisk Feb 13 '16 at 13:56
  • Github is full of tools that do this. – schroeder Feb 13 '16 at 15:36

You can passively determine the operating system by figuring out TTL's and Window Sizes from analyzing Wireshark packet captures.

These two sites may at least get you started:



| improve this answer | |
  • You can change your TTL in windows, and a lot of people do this. – Mark Buffalo Feb 13 '16 at 14:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.