> but also change how the network stack, etc. respond to various passive and active attempts at fingerprinting. I can't see how you could do this without swapp

> but also change how the network stack, etc. respond to various passive and active attempts at fingerprinting. I can't see how you could do this without swapping out part of the OS, which is where the network stack lives these days. A simpler way might be to swap out the whole OS, by using virtual machines that communicate on an internal virtual LAN: The Windows XP virtual machine sends the packets under control of the Linux virtual machine that's hosting the analysis software. > It's eventually going to throw up alarms if your macbook pro osx 10.8.2 with an valid apple or intel MAC is on a network segment, then drops off, then a machine reappears with a DECstation MAC address. It's an eternal game of cat and mouse anyway; if it isn't detailed MAC address analysis, it's subtle timing quirks, or hooking AM radio receivers to computers listening for the sounds of CPUs grinding through AES, or something else.