IoT has an identity problem. Here’s how to solve it

This post explains passive OS fingerprinting — identifying operating systems from network traffic without installing agents — by examining indicators across OSI layers: MAC vendor prefixes, TCP/IP header fields (TTL, window size, DF flag, TCP options), HTTP User-Agent and NCSI connectivity probes, and DHCP options. It illustrates examples for macOS and Windows hosts, discusses the tradeoff between granularity and reliability, and recommends a multi-protocol approach for more accurate identification.