After we have established that the target machine is alive, we can then find out which operating system is used by the target machine. This method is commonly known as Operating System (OS) fingerprinting. There are two methods of doing OS fingerprinting: active and passive.

In the active method, the tool sends network packets to the target machine and then analyzes the response it receives to determine the operating system of the target machine. The advantage of this method is that the fingerprinting process is fast. However, the disadvantage is that the target machine may notice our attempt to get its operating system's information.

To overcome the active method's disadvantage, a passive method of OS fingerprinting exists. This method was pioneered by Michal Zalewsky when he released a tool called p0f. The major advantage of passive OS fingerprinting is that it does the work while reducing the interaction between the testing machine and the target, greatly increasing the stealth of the fingerprinting. The most significant disadvantage of the passive method is that the process will be slower than for the active method.

In this section, we will describe a couple of tools that can be used for OS fingerprinting.