TCP SYN (p0f)

4:110+18:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0

first seen 2026-06-12 06:19 · last seen 2026-09-14 22:56 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

firefox 155.0.1 · Windows 10.0.26100.33296 · via geckodriver · ci — 1 session, last 2026-09-14 22:56 controlled
edge 152.0.4191.66 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-09-14 22:56 controlled
chrome 152.0.7977.83 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-09-14 22:55 controlled
powershell 7.6.5 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-09-01 00:59 controlled
powershell 5.1.26100.33296 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-09-01 00:59 controlled
firefox 154.0 · Windows 10.0.26100.33296 · via geckodriver · ci — 2 sessions, last 2026-09-01 00:59 controlled
edge 151.0.4129.93 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-08-24 20:23 controlled
powershell 7.6.4 · Windows 10.0.26100.33158 · ci — 1 session, last 2026-08-03 21:01 controlled
powershell 5.1.26100.33158 · Windows 10.0.26100.33158 · ci — 1 session, last 2026-08-03 21:00 controlled
firefox 153.0.1 · Windows 10.0.26100.33158 · via geckodriver · ci — 1 session, last 2026-08-03 21:00 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Decomposed attributes

IP version	`4`
Initial TTL	`110+18`
Options length	`0`
MSS	`1440`
Window size	`65535`
Window scale	`8`
Options layout	`mss,nop,ws,nop,nop,sok`
Quirks	`df,id+,ecn`
Payload class	`0`