ttmap

ttmap passively analyzes values of TCP Timestamps in captured IP packets. After collecting enough data, it computes characteristic remote machine parameters. These values let it guess remote operating systems and identify unique machines behind a single IP address. For example, it can analyze remote IP load-balanced clusters.