When running test on https://whoer.net/#extended

On the OS section, TCP/IP column, I get Windows NT kernel [generic] (Ethernet or modem, MTU: 1500)

The question would be how do they do that and is it possible to spoof it?

Most importantly, does this happen on client side javascript or it is completely server side and there is no way to spoof it?

Thank you!

  • 1
    A TCP proxy should help a bit. – CodesInChaos Feb 15 '18 at 12:33

As it says, it's TCP/IP and this information is based on your TCP/IP headers. You send the MTU with every TCP packet and also other details from which it is easy to conclude operating system type.

MTU size is sometimes rewritten by some home routers, they lower the value either as needed or to some preconfigured size like 1480.

  • Could I spoof it if I'm running through proxy? I noticed if I'm running vpn then TCP/IP string changes value. I'm started to feel like It will be that one thing we can't spoof and no matter how hard we try to hide our vpn/proxy, it will be always a little hint that we might be using it. Usually vpn/proxy runs on linux, there are not many users who run on linux and it gets even worse when you spoof your user agent, showing it being window. – Fadey Anomaly Feb 15 '18 at 12:45
  • @FadeyAnomaly A proxy will spoof much of this, however a VPN will not change everything. See p0f. – forest Feb 15 '18 at 12:58
  • @Aria It's not just the MTU. There is a lot more information which identifies the type of device, such as sequence IDs using their own methods of pseudo-randomness, TCP options etc. – forest Feb 15 '18 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.