Operating System Detection using Nmap
Operating System Detection using Nmap :
Introduction
Nmap can guess the operating system of a remote host by TCP/IP stack fingerprinting.
Different operating systems implement the TCP/IP protocols in slightly different ways (initial TTL, TCP window size,
TCP options and their order, how they answer unusual packets). Nmap sends a series of probes, measures the replies and
compares the result with its database of known fingerprints (nmap-os-db).
Important: scan only systems that you own or have permission to scan.
Requirements
- Nmap must be installed (see "How to run Nmap scan").
- OS detection needs raw packets, so run it as root / administrator
(
sudoon Linux and macOS). - For good results at least one open and one closed TCP port should be found on the target.
Commands
1. Basic OS detection
sudo nmap -O 192.168.1.10
Starting Nmap 7.94 ( https://nmap.org ) at 2025-01-10 11:05 IST Nmap scan report for 192.168.1.10 Host is up (0.00045s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:AB:CD:EF (VMware) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.85 seconds
The output above is only an example; it will be different for your target.
2. Other useful options
| Command | Purpose |
|---|---|
sudo nmap -O --osscan-guess host | Show the closest matches even when Nmap is not sure |
sudo nmap -O --osscan-limit host | Try OS detection only on hosts that have an open and a closed port |
sudo nmap -O -sV host | OS detection together with service version detection |
sudo nmap -A host | Aggressive scan: OS detection, version detection, default scripts and traceroute |
sudo nmap -O -v host | Verbose output (shows the reason for each guess) |
sudo nmap -O 192.168.1.0/24 | OS detection for every host of the subnet |
sudo nmap -O -oN os.txt host | Save the result to a file |
How to read the result
- Running – the operating-system family and version range.
- OS details – the most likely exact version.
- Device type – for example general purpose, router, printer or firewall.
- Network Distance – the number of hops to the target.
- Aggressive OS guesses – shown with a percentage when there is no perfect match.
- If the message "No exact OS matches for host" appears, Nmap prints the fingerprint so that it can be submitted to the Nmap database.
Observation
Record the target, the command used, the detected operating system with its accuracy and the open ports found. Explain why firewalls, virtual machines or NAT can make the detection less accurate.