Which elements does Nmap use for OS fingerprinting, and what data is typically reported?

• A. DNS responses and hostnames; reports only the device vendor.
• B. TCP/IP stack characteristics such as TTL, window size, TCP options, and response behavior; Reports OS family or device class and network distance.
• C. UDP port response patterns; reports service versions.
• D. ICMP echo responses; reports host uptime.

Answer: (B)

OS fingerprinting relies on how a host’s TCP/IP stack answers to crafted probes. Nmap looks at specific characteristics in those responses—such as the initial TTL value seen, the TCP window size, which TCP options are advertised, and how the host behaves when faced with certain unusual or malformed packets. These details vary between operating systems and networking stacks, so they form a distinctive fingerprint that helps identify the likely OS family or device class and also estimates network distance (how far away it is in hops).

DNS responses and hostnames don’t reflect the underlying networking implementation, so they aren’t useful for fingerprinting the OS, and reporting only the device vendor would miss the broader family or class information. UDP port patterns reveal which services are running and their versions, not the core OS identity. ICMP echo responses show reachability and some basic behavior but don’t provide the detailed stack characteristics used for OS inference.