I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.

But what kind of probes would distinguish a Linux system or a Windows system? A Linux 2.4 or 2.6 system? Windows XP or Windows 7 system etc?

1 Answer 1


you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon.

From NMap OS Detection:

...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its nmap-os-db database of more than 2,600 known OS fingerprints and prints out the OS details if there is a match

  • The link to the NMAP detection paper does not work anymore.
    – Jon
    Commented Oct 16, 2014 at 11:13
  • The section of the Nmap book on OS detection is very good, too: nmap.org/book/osdetect.html Commented Oct 16, 2014 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .