TCP Options Field Reference
TCP header options in SYN packets negotiate connection parameters. Set by the OS kernel, not the application — a rich source of passive fingerprinting data.
Common Options
| Kind | Name | Description |
|---|---|---|
| 2 | MSS | Typically 1460 for Ethernet. 1440 suggests VPN overhead. |
| 3 | Window Scale | Multiplier for windows larger than 65,535 bytes. |
| 4 | SACK Permitted | Selective acknowledgment for non-contiguous blocks. |
| 8 | Timestamps | Windows omits this by default — strong OS indicator. |
OS Fingerprinting
Option ordering is kernel-determined. Combined with window size, MSS, and TTL, creates reliable passive fingerprints.
Linux: MSS, SACK, Timestamps, NOP, Window Scale (window: 64240, TTL: 64) Windows: MSS, NOP, Window Scale, NOP, NOP, SACK (window: 65535, TTL: 128) macOS: MSS, NOP, Window Scale, NOP, NOP, Timestamps, SACK, EOL (TTL: 64)
Related: The TLS 1.3 Handshake