{
  "version": "0.2.0",
  "capture_status": "captured",
  "capture_method": "Linux TCP_SAVE_SYN/TCP_SAVED_SYN",
  "tcp_peer": "216.73.216.76:2436",
  "transport": "https",
  "http_protocol": "HTTP/2.0",
  "classification": {
    "os_family": "linux",
    "confidence": "low",
    "evidence": [
      "TCP option order matches a common Linux SYN layout, including timestamps.",
      "TTL conflicts with the usual family default; a middlebox or custom stack may be involved."
    ],
    "limitations": [
      "Heuristic confidence, not a calibrated probability; TCP headers can be modified or imitated.",
      "Identifies the observed TCP stack, including a proxy exit; does not establish a device identity or Linux distribution."
    ]
  },
  "fingerprint": {
    "observed_at": "2026-11-06T09:03:41.357405598Z",
    "ip_version": 4,
    "observed_ttl": 116,
    "inferred_initial_ttl": 128,
    "estimated_hops": 12,
    "dont_fragment": true,
    "window": 62727,
    "mss": 1400,
    "window_scale": 7,
    "option_kinds": [
      2,
      4,
      8,
      1,
      3
    ],
    "option_names": [
      "MSS",
      "SACK",
      "TS",
      "NOP",
      "WS"
    ],
    "options_hex": "020405780402080aef61892f0000000001030307",
    "timestamps": true,
    "sack_permitted": true,
    "ecn": false,
    "signature": "v4:ttl128:win62727:mss1400:ws7:opts2-4-8-1-3"
  },
  "scope": "IPv4 TCP peer only. User-Agent and forwarded-IP headers are not classification inputs. TCP proxies expose the exit stack."
}