TCP SYN (p0f)

4:113+15:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0

first seen 2026-07-01 00:59 · last seen 2026-10-26 20:08 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

curl 8.21.0 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:09 controlled
firefox 158.0.1 · Windows 10.0.26100.33650 · via geckodriver · ci — 1 session, last 2026-10-26 20:08 controlled
edge 155.0.4283.62 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:08 controlled
chrome 156.0.8078.48 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:08 controlled
curl 8.16.0 · Windows 10.0.26100.33296 · ci — 1 session, last 2026-08-26 06:55 controlled
firefox 152.0.3 · Windows 10.0.26100.32995 · via geckodriver · ci — 1 session, last 2026-07-14 10:54 controlled
powershell 7.6.3 · Windows 10.0.26100.32995 · ci — 1 session, last 2026-07-09 12:14 controlled
powershell 5.1.26100.32995 · Windows 10.0.26100.32995 · ci — 1 session, last 2026-07-09 12:13 controlled
firefox 152.0.1 · Windows 10.0.26100.32995 · ci — 1 session, last 2026-07-01 00:59 controlled
edge 149.0.4022.80 · Windows 10.0.26100.32995 · ci — 1 session, last 2026-07-01 00:59 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Decomposed attributes

IP version	`4`
Initial TTL	`113+15`
Options length	`0`
MSS	`1440`
Window size	`65535`
Window scale	`8`
Options layout	`mss,nop,ws,nop,nop,sok`
Quirks	`df,id+,ecn`
Payload class	`0`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t12d190800_d83cc789557e_16bbda4055b2`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn040000_cabeb744284e_000000000000_000000000000`	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`65535_2-1-3-1-1-4_1440_8`	1

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36`	1

Country

fingerprint	co-occurrences
`SG` · Singapore	1

Network (ASN)

fingerprint	co-occurrences
`AS8075` · Microsoft Corporation	1