OS Detection

How -O works

-O sends a fixed battery of probes and compares the responses against nmap-os-db. It fingerprints the TCP/IP stack, not the software you can see, so it reads a kernel rather than a banner.

sudo nmap -O 10.0.0.5
sudo nmap -O --osscan-guess 10.0.0.5
sudo nmap -A 10.0.0.5                  # includes -O

Device type: general purpose
Running: Linux 5.X|6.X
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:6
OS details: Linux 5.0 - 6.2
Network Distance: 12 hops

OS detection needs root, and it needs at least one open and one closed port to have a full set of responses to compare. A host that is entirely filtered cannot be fingerprinted this way.

What the probes measure

The fingerprint is built from stack behaviours that vary between implementations and are not configurable by an administrator.

The TTL signal is the one you can read by eye. A syn-ack ttl 64 in --reason output suggests Linux or BSD, and ttl 128 suggests Windows, before -O ever runs.

Options and accuracy

sudo nmap -O --osscan-limit 10.0.0.0/24        # skip hopeless hosts
sudo nmap -O --osscan-guess --max-os-tries 1 10.0.0.5
sudo nmap -O -v 10.0.0.5                       # shows the aggressiveness detail

Accuracy degrades in predictable ways:

Reading confidence honestly

Nmap tells you how sure it is, and that qualifier is the important part.

Aggressive OS guesses: Linux 5.0 - 6.2 (95%), Linux 4.15 - 5.19 (92%)
No exact OS matches for host (test conditions non-ideal).

Never report an OS version as fact from -O alone. It is stack-level inference, and a percentage below 100 means nmap is choosing between candidates. Corroborate with -sV banners, smb-os-discovery, or an HTTP Server header.

Corroborating with NSE

Service-level evidence is often more precise than stack fingerprinting, because services frequently announce their platform outright.

sudo nmap -O -sV 10.0.0.5                              # both layers at once
sudo nmap -p 445 --script smb-os-discovery 10.0.0.5    # Windows version and domain
sudo nmap -p 80,443 --script http-server-header 10.0.0.5
sudo nmap -p 22 --script ssh2-enum-algos 10.0.0.5      # distro hints from algorithms
sudo nmap -sV --script banner -p- --open 10.0.0.5

smb-os-discovery on a Windows host typically returns the exact OS string, the NetBIOS name, the domain, and the system time, which is far more actionable than a stack guess.

IP ID sequence and why it appears here

-O reports the IP ID generation class as a side effect, and that line is what tells you whether a host can serve as an idle-scan zombie.

sudo nmap -O -v 10.0.0.99 | grep -i 'IP ID'

IP ID Sequence Generation: Incremental

Modern Linux and Windows randomize per destination, so Incremental shows up mainly on printers, embedded devices, and older appliances. That scarcity is why the idle scan is a niche technique rather than a default.