Although TTL analysis can be helpful in identifying remote operating systems, more comprehensive solutions are ideal. Nmap has an operating system identification function that goes far beyond simple TTL analysis. This specific recipe will demonstrate how to use Nmap to perform operating system identification based on probe-response analysis.
To use Nmap to perform operating system identification, you will need to have a remote system running network services that can be probed and inspected. In the examples provided, an installation of Windows XP is used to perform this task. For more information on setting up a Windows system, please refer to the Installing Windows Server recipe in Chapter 1, Getting Started.