Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least the same (and even more) does not require special privileges?
-A without root privileges does not perform OS detection. The
-A option is a shorthand to enable many of Nmap's advanced capabilities:
- OS detection (
- service version detection (
- NSE script scanning (
- traceroute (
Of these, OS detection and traceroute require root privileges. The other two features (with the exception of just a few NSE scripts) do not require root privileges. When you use the
-A option, Nmap will enable as many of these features as it can at your current privilege level, and it will not complain or give an indication that it is leaving any out.