How Nmap OS detection works and why the guess can be wrong

The fingerprint is a set of quirks

Operating systems implement TCP/IP slightly differently. They choose initial TTL values, TCP window sizes, option orders, and IP ID sequences in recognizable ways. Nmap’s -O sends a set of crafted TCP, UDP, and ICMP probes and records those quirks into a fingerprint, then compares it to thousands of entries in nmap-os-db.

The tests need at least one open and one closed TCP port to be reliable. If every port except one is filtered, Nmap warns that the results may be unreliable, and you should believe the warning.

Reading the result

When Nmap finds a strong match, it prints “Running:” with an OS family and “OS details:” with a specific version range. When it cannot, it may print “Aggressive OS guesses” with percentages. Those percentages are similarity scores against the database, not probabilities, and a 92% guess can still be wrong.

Network devices in the path can distort the fingerprint. A NAT gateway, load balancer, or firewall that rewrites TTLs or window sizes can make every host behind it look like the same embedded Linux box.

Lab: fingerprint two different VMs

Run OS detection against a Linux VM and a Windows VM on the host-only network, using --osscan-limit so Nmap only tries hosts with the needed ports. Then add -v to see the TTL and the “Network Distance” line. Linux typically starts with a TTL of 64 and Windows with 128, which is a quick sanity check even without the full fingerprint.

Next, block all inbound ports on the Linux VM except 22 and rerun. Watch the warning appear and the guess get vaguer. That is the situation you face on well-firewalled real hosts.

Snippet

sudo nmap -O --osscan-limit -v 192.168.56.101 192.168.56.102
sudo nmap -O --osscan-guess 192.168.56.101

Using OS guesses responsibly

Treat the OS line as a lead for your inventory, then confirm it with something authoritative: an agent, a configuration management database, or SSH or WinRM access with credentials. Authenticated inventory beats remote fingerprinting every time.

For a defender, a host whose fingerprint changes between weekly scans deserves a look. It may have been rebuilt, replaced, or put behind a new device, and any of those should match a change ticket.

Diagram

A guess to note versus a result to rely on

Remote fingerprinting is evidence, not inventory truth.

Weak result

Ports. Only one open port, no closed ports seen.

Output. “Aggressive OS guesses” with several families.

Use. Lead only. Confirm before recording.

Strong result

Ports. At least one open and one closed port.

Output. “OS details” with one family and version range.

Use. Still confirm with credentials or an agent.

Check yourself

1. What does Nmap need to make a reliable OS guess?

2. What does “92%” in an aggressive OS guess mean?

3. Every host behind one gateway fingerprints as the same embedded Linux. What is likely?