it is possible to fingerprint the TCP stack of the client from their first SYN packet (and possibly other packets?) the only online demos of this i know of are

it is possible to fingerprint the TCP stack of the client from their first SYN packet (and possibly other packets?) the only online demos of this i know of are: http://witch.valdikss.org.ru/ http://witch.valdikss.org.ru/ and https://bot.incolumitas.com https://bot.incolumitas.com i believe the WITCH site is based on p0f (https://lcamtuf.coredump.cx/p0f3/ https://lcamtuf.coredump.cx/p0f3/) i know some people have custom patches to the linux kernel to make it look like a different operating system in order to work around bot detection.