There are several ways to assess the IOS, (NMap, pOf etc.), but detecting the make and model isn't something I think you can do since the responses you will get are a product of the TCP/IP...