Introduction
TCP/IP fingerprinting estimates the operating system behind a connection by analyzing low-level network packet characteristics. Unlike User-Agent strings which are trivially spoofed, TCP parameters are set by the OS kernel and are much harder to fake.
How TCP/IP Fingerprinting Works
When your computer initiates a TCP connection (SYN packet), the packet header contains several OS-dependent values:
- TTL (Time-To-Live): Windows typically uses 128, Linux 64, macOS 64. The initial TTL reveals a possible OS family, rather than proving it.
- Window Size: The initial TCP window size varies by OS and version. Windows 10/11 uses 65535, while Linux varies by kernel version.
- MSS (Maximum Segment Size): Usually 1460 for Ethernet. Values below 1460 often indicate VPN or tunnel overhead.
- TCP Options: The order, combination, and values of TCP options (SACK, timestamps, window scaling, NOP) differ significantly between operating systems.
- Don't Fragment (DF) flag: Most modern OS set DF by default, but the pattern varies with other parameters.
p0f — Passive OS Fingerprinting
The p0f tool, created by Michal Zalewski, is the most well-known passive fingerprinting tool. It maintains a database of OS signatures based on SYN packet characteristics. Zunavek uses a custom Go implementation that matches against the p0f signature database.
Key advantages of passive fingerprinting:
- Requires no JavaScript — works at the network level
- Cannot be blocked by browser extensions
- Can observe TCP characteristics preserved through some VPN tunnels
- Does not require extra probe traffic to the target
A TCP-terminating proxy creates its own outbound connection, so the destination observes that proxy's TCP stack rather than the original client's. Tor similarly has the exit relay open a new TCP connection; see the Tor protocol introduction.
VPN Detection via MTU Analysis
VPN tunnels add overhead to each packet (encapsulation headers). This reduces the effective MTU, which shows up as a reduced MSS in TCP SYN packets:
- Normal Ethernet: MSS = 1460 (MTU 1500)
- WireGuard: MSS ≈ 1380 (MTU 1420)
- OpenVPN: MSS ≈ 1370-1390
- IPSec: MSS ≈ 1350-1400
An MSS below 1460 can be consistent with tunnel overhead, but other network paths and configurations also reduce MSS. It is a heuristic, not proof of VPN use.
OS Mismatch Detection
One of the most powerful uses of TCP fingerprinting is cross-referencing it with the browser's User-Agent string. If the UA claims “Windows 10” but the TCP fingerprint matches Linux, possible explanations include automation, a modified User-Agent, or a TCP-terminating intermediary. A mismatch alone does not prove spoofing.
Mitigation
TCP fingerprinting is extremely difficult to prevent because the values are set by the OS kernel:
- Tor: The destination observes the exit relay's outbound TCP stack
- Custom kernel tuning: Advanced users can modify sysctl values on Linux to change TTL, window size, etc.
- Consistent UA: Ensure your User-Agent matches the OS your TCP stack reveals
Check Your TCP Fingerprint
Run a Full Privacy Scan on Zunavek to see your TCP/IP fingerprint, detected OS, and whether it matches your User-Agent. MSS-based tunnel indicators provide context rather than a definitive VPN diagnosis.