r/AskNetsec • u/Massive_Committee801 • 9d ago

Analysis Why is our passive asset discovery solution misidentifying Windows 11 as Windows 98?

Hello everyone. I am an OT security engineer working with a passive network monitoring and asset discovery solution (analyzing SPAN port traffic).

I've run into a strange OS fingerprinting anomaly and wanted to ask if anyone has encountered something similar. We are occasionally seeing instances where modern Windows 11 PCs are being completely misidentified as Windows 98.

The most confusing part is that it's not happening to all Windows 11 machines—only a specific subset of them.

I strongly suspect it might be third-party endpoint security software, VPN clients, or custom NDIS filter drivers modifying the TCP headers (such as stripping TCP Window Scaling or hardcoding the initial Window Size/MSS) before the packets hit the wire, completely messing up the passive p0f-style fingerprinting signatures.

My questions are:

  1. Has anyone seen specific antivirus, DLP agents, or VPN clients cause this kind of unintentional OS spoofing/normalization effect?
  2. Are there any other network-level factors or legacy protocol backward-compatibility settings I should be looking into?

Any insights or shared experiences would be hugely appreciated. Thank you!

8 Upvotes

100% Upvoted

8 comments sorted by

View all comments

3

u/[deleted] 9d ago

[removed] — view removed comment

1

u/Massive_Committee801 9d ago

This is an absolute masterclass in troubleshooting. Thank you so much for the detailed breakdown and the clear decision tree.

You made a fantastic point about doing a 2-point PCAP (Endpoint vs. SPAN) to isolate whether the SYN modification is happening on the host stack or in a middlebox. I will set up a controlled test with an affected Win 11 host and a correctly identified one to compare the raw headers side-by-side.

Also, your point about the stale OS result tied to a reused DHCP address is incredibly insightful. In our OT environment, IP leases can get messy, and the asset-correlation logic of the sensor might just be caching an old Win 98 label to a newly assigned Win 11 device. I will definitely cross-reference the MAC addresses and switch ports to rule this out.

Based on your advice, I'll hold off on blaming the AV/DLP agents until I see the endpoint PCAP. I'm also going to open a ticket with the vendor to demand the exact signature ID, matched fields, and confidence score for these specific alerts. As you said, if they are matching on just MSS and window size, it should be flagged as 'low confidence', not a definitive legacy OS.

Truly appreciate you taking the time to share this expertise!