Which of the following is a typical drawback of OS detection with -O?

• A. It may require privileged access.
• B. It may be unreliable behind firewalls, NAT, or IDS.
• C. It always produces perfect results.
• D. It requires physical access to the device.

Answer: (B)

OS detection with -O works by sending a variety of probes and comparing the host’s replies to a fingerprint database. The typical drawback is that network devices in the path—firewalls, NATs, and IDSs—can interfere with those probes, block or alter responses, and mask the true characteristics of the target’s TCP/IP stack. This can make fingerprints unreliable, leading to incorrect OS guesses or no result at all.

Other options aren’t the main issue in practice: while privileged access is often required to send raw packets, that’s a setup constraint rather than a reliability problem; OS detection isn’t guaranteed to be perfect in all cases, but saying it always is ignores real-world noise; and you don’t need physical access to perform remote OS detection.