Quote:
. The windows size is 65502 but changes for every packet. So this is probably a windows machine based on the fact that it changes.This is not a reliable method because it can be changed by a program rather than the os.
Window size can change based on network congestion (sender based flow control IE: congestion window which is not advertised. Look into "slow start" or "congestion avoidance" in TCP/IP) or the buffer space of the designation (receiver based flow control which is advertised). This is true for all network clients , but you can make guesses as to what an OS is by it's