下面是简单介绍两款有识别功能的软件。
1、 著名的nmap，他采用的是主动式探测，探测时会主动向目标系统发送探测包，根据目标目标机回应的数据包来，叛断对方机的操作系统。用法如下：
F:/nmap>nmap -vv -sS -O 10.1.1.5
Starting nmap V. 3.00
Host IS~123456ADCD (10.1.1.5) appears to be up ... good.
Initiating SYN Stealth Scan against IS~123456ADCD (10.1.1.5)
Adding open port 139/tcp
Adding open port 7070/tcp
Adding open port 554/tcp
Adding open port 23/tcp
Adding open port 1025/tcp
Adding open port 8080/tcp
Adding open port 21/tcp
Adding open port 5050/tcp
Adding open port 9090/tcp
Adding open port 443/tcp
Adding open port 135/tcp
Adding open port 1031/tcp
Adding open port 3372/tcp
Adding open port 25/tcp
Adding open port 1433/tcp
Adding open port 3389/tcp
Adding open port 445/tcp
Adding open port 80/tcp
The SYN Stealth Scan took 1 second to scan 1601 ports.
For OSScan assuming that port 21 is open and port 1 is closed and neither ar
rewalled
Interesting ports on IS~123456ADCD (10.1.1.5):
(The 1583 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
23/tcp open telnet
25/tcp open smtp
80/tcp open http
135/tcp open loc-srv
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
554/tcp open rtsp
1025/tcp open NFS-or-IIS
1031/tcp open iad2
1433/tcp open ms-sql-s
3372/tcp open msdtc
3389/tcp open ms-term-serv
5050/tcp open mmcc
7070/tcp open realserver
8080/tcp open http-proxy
9090/tcp open zeus-admin
Remote operating system guess: Windows 2000/XP/ME
OS Fingerprint:
TSeq(Class=RI%gcd=1%SI=21F8%IPID=I%TS=0)
T1(Resp=Y�=Y%W=FAF0琄=S %Flags=AS%Ops=MNWNNT)
T2(Resp=Y�=N%W=0琄=S%Flags=AR%Ops=)
T3(Resp=Y�=Y%W=FAF0琄=S %Flags=AS%Ops=MNWNNT)
T4(Resp=Y�=N%W=0琄=O%Flags=R%Ops=)
T5(Resp=Y�=N%W=0琄=S %Flags=AR%Ops=)
T6(Resp=Y�=N%W=0琄=O%Flags=R%Ops=)
T7(Resp=Y�=N%W=0琄=S %Flags=AR%Ops=)
PU(Resp=Y�=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134赥=E)
TCP Sequence Prediction: Class=random positive increments
Difficulty=8696 (Worthy challenge)
TCP ISN Seq. Numbers: 5B9022E2 5B914E12 5B92A495 5B93915A 5B94A9B5 5B95CC64
IPID Sequence Generation: Incremental
Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
其中 Remote operating system guess: Windows 2000/XP/ME 这行就是NMAP对操作系统类型的判断。还返回了好多信息，NMAP不愧为扫描之王。
2、天眼，采用的是被动式的探测方法。不向目标系统发送数据包，只是被动地探测网络上的通信数据，通过分析这些数据来判断操作系统的类型。配合supersan使用，较果很好。
具体的使用方法，在此就不具体介绍了。有兴趣的的朋友能够到网上搜一下关于天眼使用方法的文章，会有很多的。
以上讲解了一些对操作系统识别的基本方法。由于本人水平有限，不当之处，还请高手斧正！
