I remember when I was in college and we were doing work about passive OS fingerprinting and we used p0f, Vista was a new OS back then and we fingerprinted it successfully before p0f got its own signatures, it was so cool. It was around 15 years ago, my god time flies so fast.
It’s still great for that exact purpose. Knowing that your SMTP peer is running Windows XP is the strongest spam fighting signal that has ever existed.
Not OP but: Linux with TTL modified to look like Windows+1 to avoid tethering prevention gets actively proxied by an enterprise security/nat appliance. What fingerprint do you expect to see and what would you want to learn from it? That kind of thing.
If you update the fingerprints, it will still work fine.
Application layer or session layer stuff like encryption is irrelevant, the fingerprints are largely based on differences at the transport layer and below.
You can also do some nice fingerprinting at the TLS layer based on stuff like what ciphers are offered, the order of them, etc.
Do you mean via this script - https://svn.nmap.org/nmap/scripts/clock-skew.nse , if so it looks like that's extracting time values from protocols above TCP such as HTTP etc? Please correct me, if I misunderstood what you meant.
Too bad it doesn't work on Windows out of thr box without cygwin/msys trickery. The lippcap doesnt have an open source alternative on windows. winpcap is almost dead and npcap is not free to use.
