TCP SYN (p0f)

4:112+16:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0

first seen 2026-06-12 16:08 · last seen 2026-10-19 20:08 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

chrome 155.0.8059.40 · Windows 10.0.26100.33438 · ci — 1 session, last 2026-10-19 20:08 controlled
curl 8.16.0 · Windows 10.0.26100.33158 · ci — 1 session, last 2026-08-18 09:04 controlled
firefox 153.0.3 · Windows 10.0.26100.33158 · via geckodriver · ci — 1 session, last 2026-08-17 20:19 controlled
edge 151.0.4129.72 · Windows 10.0.26100.33158 · ci — 1 session, last 2026-08-17 20:19 controlled
firefox 151.0.3 · Windows 10.0.26100.32860 · ci — 1 session, last 2026-06-12 16:08 controlled
edge 149.0.4022.52 · Windows 10.0.26100.32860 · ci — 1 session, last 2026-06-12 16:08 controlled
chrome 149.0.7827.54 · Windows 10.0.26100.32860 · ci — 1 session, last 2026-06-12 16:08 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Decomposed attributes

IP version	`4`
Initial TTL	`112+16`
Options length	`0`
MSS	`1440`
Window size	`65535`
Window scale	`8`
Options layout	`mss,nop,ws,nop,nop,sok`
Quirks	`df,id+,ecn`
Payload class	`0`