TCP SYN (p0f)

4:46+18:0:1460:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:id-,ecn:0

first seen 2026-06-12 05:58 · last seen 2026-09-07 22:27 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

chrome 152.0.7977.65 · macOS 15.7.9 · ci — 1 session, last 2026-09-07 22:27 controlled
curl 8.7.1 · macOS 26.5.2 · ci — 1 session, last 2026-08-26 06:42 controlled
firefox 153.0 · macOS 26.5.2 · via geckodriver · ci — 1 session, last 2026-08-26 06:41 controlled
safari 26.5.2 · macOS 26.5.2 · ci — 1 session, last 2026-08-26 06:34 controlled
firefox 151.0.2 · macOS 15.7.7 · ci — 1 session, last 2026-06-12 06:23 controlled
chrome 148.0.7778.179 · macOS 15.7.7 · ci — 2 sessions, last 2026-06-12 06:20 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Decomposed attributes

IP version	`4`
Initial TTL	`46+18`
Options length	`0`
MSS	`1460`
Window size	`65535`
Window scale	`6`
Options layout	`mss,nop,ws,nop,nop,ts,sok,eol+1`
Quirks	`id-,ecn`
Payload class	`0`