I have been asked to write a small tool that detects the running OS on a victim device.

The tool should be able to fingerprint Linux versus Android versus iOS. Extra credit for version info. It needs to be done through analysing network traffic. Unfortunately, I know nothing about this, or how it works, or even how to get started. I would appreciate a lot if someone could help and give me starter code.

closed as too broad by schroeder Feb 13 '16 at 15:36

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Go look at the nmap source code. – Mark Buffalo Feb 13 '16 at 12:28
  • 1
    If ttl = 64 then it's linux. If ttl = 128, then it's windows. If ttl = 255, then it's a routing device or unix. If port 111 is open, then it's linux or unix. If port 135/139/445 are open, then it's windows. Bear in mind these are all defaults and can be changed. – Lutefisk Feb 13 '16 at 13:45
  • forgot to mention iOS is also 255 – Lutefisk Feb 13 '16 at 13:56
  • Github is full of tools that do this. – schroeder Feb 13 '16 at 15:36

You can passively determine the operating system by figuring out TTL's and Window Sizes from analyzing Wireshark packet captures.

These two sites may at least get you started:



  • You can change your TTL in windows, and a lot of people do this. – Mark Buffalo Feb 13 '16 at 14:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.