This is old and very good tool for passive identification. I wrote my engineer thesis based on p0f 10 years ago. It mostly uses differences in implementation of

This is old and very good tool for passive identification. I wrote my engineer thesis based on p0f 10 years ago. It mostly uses differences in implementation of TCP/IP stacks between OS and couple of other things to recognize the OS. You can add new fingerprints yourself.