. The windows size is 65502 but changes for every packet. So this is probably a windows machine based on the fact that it changes.This is not a reliable method because it can be changed by a program rather than the os.
Window size can change based on network congestion (sender based flow control IE: congestion window which is not advertised. Look into "slow start" or "congestion avoidance" in TCP/IP) or the buffer space of the designation (receiver based flow control which is advertised). This is true for all network clients , but you can make guesses as to what an OS is by it's starting advertised window size.



5. The protocol id is 06 (TCP/IP). Where can i find a listing of the protocol id#'s?
http://www.iana.org/assignments/protocol-numbers


Its IPv4 with 20 bytes apiece for TCP/IP
No, that field states the IP header length period.


8. The next word is 18 which comes to 24 in decimal. I think this means that the urgent flag and ack flags are set but I am not really sure.
Convert to binary and do a bit placement comparison.



Have fun