=7B-85%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Nintendo Wii, loaded the homebrew TCP loader on port 8080 to get an open port.
Fingerprint Nintendo Wii game console
Class Nintendo | embedded || game console
CPE cpe:/h:nintendo:wii
SEQ(SP=F8-108%GCD=1-6%ISR=105-111%II=I%TS=U)
OPS(O1=M5B4NNS%O2=M578NNS%O3=M280NNS%O4=M218NNS%O5=M218NNS%O6=M109NNS)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M109NNS%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Wii running Homebrew Channel; port 4299 is open
# Firmware 4.0U
Fingerprint Nintendo Wii game console
Class Nintendo | embedded || game console
CPE cpe:/h:nintendo:wii
SEQ(SP=F8-108%GCD=1-6%ISR=105-111%II=I%TS=U)
OPS(O1=M5B4NNS%O2=M578NNS%O3=M280NNS%O4=M218NNS%O5=M218NNS%O6=M109NNS)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M109NNS%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Wii System Update 4.1U
Fingerprint Nintendo Wii game console
Class Nintendo | embedded || game console
CPE cpe:/h:nintendo:wii
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Espressif ESP8266 running NodeMCU
Fingerprint NodeMCU firmware (lwIP stack)
Class NodeMCU | embedded || specialized
CPE cpe:/o:nodemcu:nodemcu
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip
SEQ(SP=5C-8A%GCD=1-6%ISR=C4-CE%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Espressif ESP8266
Fingerprint NodeMCU firmware (lwIP stack)
Class NodeMCU | embedded || specialized
CPE cpe:/o:nodemcu:nodemcu
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip
SEQ(SP=1A-9A%GCD=1-6%ISR=6C-84%TI=I|RD%CI=I|RD%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=16D0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Nokia IPSO 4.1Build19 firewall
Fingerprint Nokia firewall (IPSO 4.1Build19)
Class Nokia | IPSO | 4.X | firewall
CPE cpe:/o:nokia:ipso:4.1build19 auto
SEQ(SP=F8-102%GCD=1-6%ISR=105-10F%TI=I|RD%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4334%W5=4180%W6=403D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(R=N)
IE(R=N)

# IPSO v4.1 build 50 running on an IP330
# IPSO Nokia.com 4.2-BUILD096 releng 1515  12.05.2008-053151 i386
Fingerprint Nokia IP330 firewall appliance (IPSO 4.1 - 4.2)
Class Nokia | IPSO | 4.X | firewall
CPE cpe:/o:nokia:ipso:4 auto
SEQ(SP=FB-109%GCD=1-6%ISR=103-10F%TI=I%II=I%SS=S%TS=1)
OPS(O1=M400NW0NNT11%O2=M400NW0NNT11%O3=M400NW0NNT11%O4=M400NW0NNT11%O5=M400NW0NNT11%O6=M400NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4334%W5=4180%W6=403D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M400NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IPSO 4.0-BUILD023 releng 1515  10.05.2005-011351 i386
Fingerprint Nokia IP650 firewall (IPSO 4.0 and CheckPoint Firewall-1/VPN-1 software)
Class Nokia | IPSO | 4.X | firewall
CPE cpe:/o:nokia:ipso:4.0 auto
SEQ(SP=F0-10E%GCD=1-6%ISR=FB-109%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4334%W5=4180%W6=403D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# execute the program SymSMB in the Nokia 5800 and run nmap.
Fingerprint Nokia 5800 mobile phone (Symbian OS 9.4)
Class Nokia | Symbian OS | 9.X | phone
CPE cpe:/o:nokia:symbian_os:9.4 auto
SEQ(SP=F7-101%GCD=1-6%ISR=104-10E%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT00NNS%O2=M5B4NW0NNT00NNS%O3=M5B4NW0NNT00%O4=M5B4NW0NNT00NNS%O5=M5B4NW0NNT00NNS%O6=M5B4NNT00NNS)
WIN(W1=4470%W2=41A0%W3=4100%W4=40E8%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=7C-86%TG=80%W=4470%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=7C-86%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=DE73%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia N95 - Symbian Series 60, Release 3, V 10.0.018, 15-03-07, RM-159
# Nokia N95 running Symbian OS 9.2
# Nokia e90 communicator running Symbian 9.2
# Nokia S60 Series 3
# Nokia E51
# Nokia N86 8MP RM-484 Firmware 30.009.54.1 Symbian OS v9.3
Fingerprint Nokia E51, N86, E90 Communicator, or N95 mobile phone (Symbian OS 9.2 - 10.0)
Class Nokia | Symbian OS | 9.X | phone
CPE cpe:/o:nokia:symbian_os:9 auto
Class Nokia | Symbian OS | 10.X | phone
CPE cpe:/o:nokia:symbian_os:10 auto
SEQ(SP=A0-B0%GCD=1-6%ISR=AB-B9%TI=I%II=I%SS=S%TS=D|13|14)
OPS(O1=M5B4NNT11NW0NNS%O2=M5B4NNT11NW0NNS%O3=M5B4NNT11NW0%O4=M5B4NNT11NW0NNS%O5=M5B4NNT11NW0NNS%O6=M5B4NNT11NNS)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=FAF0%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=FAF0%S=O%A=S+%F=AS%O=M5B4NNT11NW0NNS%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia E55 mobile phone
# S60 3rd Edition Feature Pack 2 (S60 3.2.3) Symbian OS version 9.3
Fingerprint Nokia E55 or S60 mobile phone (Symbian OS 9.3)
Class Nokia | Symbian OS | 9.X | phone
CPE cpe:/o:nokia:symbian_os:9.3 auto
SEQ(SP=A6-B2%GCD=1-6%ISR=AF-B9%TI=I%CI=I%II=I%SS=S%TS=12-14)
OPS(O1=M5B4NNT11NW1NNS%O2=M5B4NNT11NW1NNS%O3=M5B4NNT11NW1%O4=M5B4NNT11NW1NNS%O5=M5B4NNT11NW1NNS%O6=M5B4NNT11NNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FAF0)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=FFFF%O=M5B4NW1NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=FFFF%S=O%A=S+%F=AS%O=M5B4NNT11NW1NNS%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia E70 S60 3.0 (S60 3rd Edition) / Symbian OS 9.1
Fingerprint Nokia E70 mobile phone (Symbian OS 9.1)
Class Nokia | Symbian OS | 9.X | phone
CPE cpe:/o:nokia:symbian_os:9.1 auto
SEQ(SP=A7-B1%GCD=1-6%ISR=AD-BB%TI=I%II=I%SS=S%TS=12|14|18)
OPS(O1=M5B4T11W0SL%O2=M5B4T11W0SL%O3=M5B4T11W0LLL%O4=M5B4T11W0SL%O5=M5B4T11W0SL%O6=M5B4T11S)
WIN(W1=BC34%W2=BC34%W3=BC34%W4=BC34%W5=BC34%W6=BC34)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%O=M5B4W0SLLL%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Phone's About... box says it is S60 (a Symbian version?).
Fingerprint Nokia S60 mobile phone (Symbian OS 9.3)
Class Nokia | Symbian OS | 9.X | phone
CPE cpe:/o:nokia:symbian_os:9.3 auto
SEQ(SP=A9-B3%GCD=1-6%ISR=AE-B8%TI=I%CI=I%II=I%SS=S%TS=14)
OPS(O1=M5B4NNT11NW0NNS%O2=M5B4NNT11NW0NNS%O3=M5B4NNT11NW0%O4=M5B4NNT11NW0NNS%O5=M5B4NNT11NW0NNS%O6=M5B4NNT11NNS)
WIN(W1=BC34%W2=BC34%W3=BC34%W4=BC34%W5=BC34%W6=BC34)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%O=M5B4NW0NNS%CC=N)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%S=O%A=O|S+%F=AS%O=M5B4NNT11NW0NNS%RD=0)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia 3600i, V 03.41, 11-04-08, RM-337, Variant: 00.00
Fingerprint Nokia 3600i mobile phone
Class Nokia | Symbian OS || phone
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=F-19%GCD=4E2|9C4|EA6|1388|186A%ISR=60-6A%TI=I%CI=I%II=I%SS=S%TS=5)
OPS(O1=NNT11|M5B4T11S%O2=NNT11|M5B4T11S%O3=NNT11|M5B4T11LL%O4=NNT11|M5B4T11S%O5=NNT11|M5B4T11S%O6=NNT11|M5B4T11S)
WIN(W1=6B78%W2=71DC%W3=70D8%W4=7094%W5=7094%W6=6FAD)
ECN(R=N)
T1(R=N)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Nokia E60 wifi enabled mobile phone, firmware version 3.
Fingerprint Nokia E60 mobile phone (Symbian OS)
Class Nokia | Symbian OS || phone
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=FF-109%GCD=1-6%ISR=108-112%TI=RD%TS=A)
OPS(O1=M5B4NW8NNT11SLL%O2=M5B4NW8NNT11SLL%O3=M5B4NW8NNT11%O4=M5B4NW8NNT11SLL%O5=M5B4NW8NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FECC%W2=FECC%W3=FECC%W4=FECC%W5=FECC%W6=FECC)
ECN(R=Y%DF=Y%T=41%TG=40%W=FECC%O=M5B4NW8SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia E61 Symbian OS - firmware version 3.0633.0904/20-11-06
# Nokia E65 mobile phone
# Nokia E70 Firmware 3.0633.09.04
# 3.0633.09.04 20-11-06 RM-49 Nokia E60 (output of *#0000#)
Fingerprint Nokia E60, E61, E65, or E70 mobile phone (Symbian OS)
Class Nokia | Symbian OS || phone
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=9E-B0%GCD=1-6%ISR=AF-B9%TI=I%II=I%SS=S%TS=13|14)
OPS(O1=M5B4T11W0SL%O2=M5B4T11W0SL%O3=M5B4T11W0LLL%O4=M5B4T11W0SL%O5=M5B4T11W0SL%O6=M5B4T11S)
WIN(W1=BC34%W2=BC34%W3=BC34%W4=BC34%W5=BC34%W6=BC34)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%O=M5B4W0SLLL%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%S=O%A=S+%F=AS%O=M5B4T11W0SL%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia E65 phone with Wifi turned on, *#0000# says "2.0633.65.01 03-10-07 RM 208 Nokia e65"
Fingerprint Nokia E65 mobile phone (Symbian OS)
Class Nokia | Symbian OS || phone
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=CB-D5%GCD=1-6%ISR=C8-D2%TI=Z%II=I%TS=8)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Nokia E70 Mobile Phone connected by Wifi, Software version 2.0618.07.10
# Nokia N86 mobile phone (Symbian OS)
Fingerprint Nokia E70 or N86 mobile phone (Symbian OS)
Class Nokia | Symbian OS || phone
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=A3-AD%GCD=1-6%ISR=B1-BB%TI=I%II=I%SS=O|S%TS=13|14)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# symbian s60 3rd edition ...nokia 81, test behind cisco asa in different vlan without acl
Fingerprint Nokia N81 mobile phone (Symbian OS)
Class Nokia | Symbian OS || phone
CPE cpe:/h:nokia:n81
CPE cpe:/o:nokia:symbian_os auto
SEQ(SP=EE-10A%GCD=1-6%ISR=EC-110%TI=I%II=I%SS=S%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=BC34%W2=BC34%W3=BC34%W4=BC34%W5=BC34%W6=BC34)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=BC34%O=M564%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# This is a Nortel CS1000M VOIP Call server
# Xerox Phaser 8560DT
Fingerprint Nortel CS1000M VoIP PBX or Xerox Phaser 8560DT printer
Class Nortel | embedded || PBX
CPE cpe:/h:nortel:cs1000m
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_8560dt
SEQ(SP=FF-109%GCD=1-6%ISR=102-110%TI=I%TS=6)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=5F-69%TG=80%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=5F-69%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=5F-69%TG=80%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=5F-69%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=5F-69%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=5F-69%TG=80%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=5F-69%TG=80%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=5F-69%TG=80%CD=S)

# Nortel Ethernet Routing Switch 5530-24TFD, BOSS 4.2, HW:32  FW:4.2.0.12  SW:v4.2.0.002
Fingerprint Nortel 5530 Ethernet Routing Switch
Class Nortel | embedded || router
CPE cpe:/h:nortel:ethernet_routing_switch_5530
SEQ(SP=94-A2%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Nortel VPN Router NVR1750D (aka Contivity Extranet Switch CES1750D)
Fingerprint Nortel NVR1750D VPN router
Class Nortel | embedded || router
CPE cpe:/h:nortel:nvr1750d auto
SEQ(SP=95-9F%GCD=1-6%ISR=96-A0%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2238%W2=20D0%W3=2080%W4=2000%W5=2180%W6=2017)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2238%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Nortel BNT Layer 2/3 Copper Gigabit Ethernet Switch Module for IBM BladeCenter Software Version 1.5.7.0
Fingerprint Nortel BNT Ethernet switch module
Class Nortel | embedded || switch
SEQ(SP=82-DA%GCD=2|4|6|8|A%ISR=8C-CC%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Nortel DMS-10 telephony switch
Fingerprint Nortel DMS-10 telephony switch
Class Nortel | embedded || switch
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2017)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Nortel Ethernet Routing Switch 4550T-PWR, v5.1.4.008
Fingerprint Nortel Ethernet Routing Switch 4550T-PWR
Class Nortel | embedded || switch
CPE cpe:/h:nortel:ethernet_routing_switch_4550t-pwr
SEQ(SP=102-10C%GCD=1-6%ISR=105-10F%TI=I%CI=RD|RI%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=2A-42%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Ethernet Switch 470-24T-PWR 24 10/100BaseTX plus 2 GBIC slots
Fingerprint Nortel Ethernet Routing Switch 470-24T-PWR
Class Nortel | embedded || switch
CPE cpe:/h:nortel:ethernet_routing_switch_470-24t-pwr
SEQ(SP=97-A1%GCD=1-6%ISR=9C-A6%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Nortel 5510-48T
Fingerprint Nortel Ethernet Routing Switch 5510
Class Nortel | embedded || switch
CPE cpe:/h:nortel:ethernet_routing_switch_5510
SEQ(SP=95-9F%GCD=1-6%ISR=9A-A4%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M514NW0NNT11%O2=M514NW0NNT11%O3=M514NW0NNT11%O4=M514NW0NNT11%O5=M514NW0NNT11%O6=M514NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=2000%O=M514NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3A-44%TG=40%W=2000%S=O%A=S+%F=AS%O=M514NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3A-44%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3A-44%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3A-44%TG=40%CD=S)

# ERS-8606 (5.1.1.1)
# Ethernet Routing Switch 8010 Software Release 4.1.2.0
Fingerprint Nortel Ethernet Routing Switch 8010 or 8606
Class Nortel | embedded || switch
CPE cpe:/h:nortel:ethernet_routing_switch_8010
CPE cpe:/h:nortel:ethernet_routing_switch_8606
SEQ(SP=94-9E%GCD=1-6%ISR=9B-A5%TI=I%CI=I%II=RI%SS=O|S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Nortel switch
Fingerprint Nortel switch
Class Nortel | embedded || switch
SEQ(SP=2A-34%GCD=FA|1F4|2EE|3E8|4E2%ISR=8A-94%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=0B-15%TG=20%W=400%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=0B-15%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=0B-15%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=U)
T3(R=Y%DF=N%T=0B-15%TG=20%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=0B-15%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=0B-15%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=0B-15%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=0B-15%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=0B-15%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=0B-15%TG=20%CD=S)

# Novetel's MiFi 2200 device issued on Verizon's network, from WLAN interface
Fingerprint Novatel MiFi 2200 3G WAP
Class Novatel | embedded || WAP
CPE cpe:/h:novatel:mifi_2200_3g auto
SEQ(SP=CE-D8%GCD=1-6%ISR=D5-DF%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=75-7F%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=75-7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=75-7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=75-7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=75-7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=75-7F%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=215F%RUD=G)
IE(DFI=N%T=75-7F%TG=80%CD=Z)

# Novatel Mifi 4620L with MiFi4620L_3.30.12_3.30.13_Real firmware
Fingerprint Novatel MiFi 4620L WAP
Class Novatel | embedded || WAP
CPE cpe:/h:novatel:mifi_4620l auto
SEQ(SP=CE-D8%GCD=1-6%ISR=D5-DF%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=7918%W2=7918%W3=7918%W4=7918%W5=7918%W6=7918)
ECN(R=Y%DF=N%T=72-7C%TG=80%W=7918%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=72-7C%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=72-7C%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=72-7C%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=72-7C%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=72-7C%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=72-7C%TG=80%IPL=240%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=8499%RUD=I)
IE(DFI=N%T=72-7C%TG=80%CD=Z)

# Novell Netware 3.12 running under KVM. "TCP/IP for Netware Version 2.02i".
Fingerprint Novell NetWare 3.12 TCP/IP 2.02i
Class Novell | NetWare | 3.X | general purpose
CPE cpe:/o:novell:netware:3.12
SEQ(SP=C-16%GCD=35A3|6B46|A0E9|D68C|10C2F%ISR=8A-94%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=5B4%W2=578%W3=780%W4=648%W5=648%W6=73F)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=5B4%O=M5B4%CC=N)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=FFFF%S=O%A=O%F=ASF%O=M109%RD=0)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Netware 3.12, TCP/IP Version 4.01G Common Stack
Fingerprint Novell NetWare 3.12 TCP/IP 4.01g
Class Novell | NetWare | 3.X | general purpose
CPE cpe:/o:novell:netware:3.12 auto
SEQ(SP=0-5%GCD=20|40|60|80|A0%ISR=3D-47%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M5B4%O4=M5B4%O5=M218%O6=M109)
WIN(W1=1FFF%W2=1FFF%W3=1FFF%W4=1FFF%W5=1FFF%W6=1FFF)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1FFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=1FFE%S=O%A=O%F=AS%O=M5B4%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell NetWare 4.11 running under VMWare
# Netware 4.11 Virgin Install, with TCPIP NLM bound to Ethernet_II adapter on a VMWare Player instance
Fingerprint Novell NetWare 4.11
Class Novell | NetWare | 4.X | general purpose
CPE cpe:/o:novell:netware:4.11
SEQ(SP=C-16%GCD=10|20|30|40|50%ISR=3C-46%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=7D0%W2=7D0%W3=7D0%W4=7D0%W5=7D0%W6=7D0)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=7D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=7D0%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Netware 4.2 SP9, TCPIP.NLM 5.22y (August 24 2000)
Fingerprint Novell Netware 4.2
Class Novell | NetWare | 4.X | general purpose
CPE cpe:/o:novell:netware:4 auto
SEQ(SP=C4-CE%GCD=1-6%ISR=C7-D1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M5B4%O4=M5B4%O5=M218%O6=M109)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=17FF%S=O%A=O%F=AS%O=M5B4%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Netware 5
Fingerprint Novell NetWare 5
Class Novell | NetWare | 5.X | general purpose
CPE cpe:/o:novell:netware:5.0
SEQ(SP=FD-107%GCD=1-6%ISR=105-10F%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=17FF%W2=17FF%W3=17FF%W4=17FF%W5=17FF%W6=17FF)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=17FF%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Netware 5.1
Fingerprint Novell NetWare 5.1
Class Novell | NetWare | 5.X | general purpose
CPE cpe:/o:novell:netware:5.1
SEQ(SP=F5-FF%GCD=1-6%ISR=107-111%TI=BI%II=BI%SS=O|S%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=17FF%W2=17FF%W3=17FF%W4=17FF%W5=17FF%W6=17FF)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=17FF%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell NetWare 6
Fingerprint Novell NetWare 6
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6 auto
SEQ(CI=I)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# novell netware 6.0
# Novell Open Enterprise Server, Netware 6.5, Support Pack Revision 07
Fingerprint Novell NetWare 6.0 or 6.5 SP5 - SP7
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.0:sp5
CPE cpe:/o:novell:netware:6.0:sp6
CPE cpe:/o:novell:netware:6.0:sp7
CPE cpe:/o:novell:netware:6.5:sp5
CPE cpe:/o:novell:netware:6.5:sp6
CPE cpe:/o:novell:netware:6.5:sp7
SEQ(SP=FD-109%GCD=1-6%ISR=F9-111%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4W1NSNN%O2=M578W1NSNN%O3=M280W1N%O4=M5B4W1NSNN%O5=M218W1NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W1NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Neware 6.5 with SP5
# Novell NetWare 6.0 Support Pack 5 on x86
# Novell NetWare 6.5 SP5 CPR Release, Server Version 5.70.05
# Novell Netware 6.5 German
# Novell Netware 6 Support Pack Revision 05, Server Version 5.60.05 May 27, 2004
Fingerprint Novell NetWare 6.0 SP5 or 6.5 SP5
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.0:sp5
CPE cpe:/o:novell:netware:6.5:sp5
SEQ(SP=F5-10D%GCD=1-6%ISR=9A-111%TI=BI|RD|RI%II=BI|RI%SS=S%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell NetWare 6.5
Fingerprint Novell NetWare 6.5
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5
SEQ(SP=F1-FB%GCD=1-6%ISR=FC-106%TI=RD%II=BI|RI%TS=U)
OPS(O1=M5B4W2NSNN%O2=M578W2NSNN%O3=M280W2N%O4=M5B4W2NSNN%O5=M218W2NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W2NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# 6.5 sp 3 or sp 5
Fingerprint Novell NetWare 6.5
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5
SEQ(SP=F7-105%GCD=1-6%ISR=109-113%TI=BI%CI=BI%TS=U)
OPS(O1=M5B4W2NSNN%O2=M578W2NSNN%O3=M280W2N%O4=M5B4W2NSNN%O5=M218W2NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W2NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(R=N)

# Novell Open Enterprise Server 6.5 Server Version 5.7.06
Fingerprint Novell NetWare 6.5 Open Enterprise Server
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5
SEQ(R=N)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Open Enterprise Server, NetWare 6.5, Support Pack 06
# Novell NetWare 6.5
# Netware 6.5 SP8
Fingerprint Novell NetWare 6.5 Open Enterprise Server
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5
SEQ(SP=FE-10D%GCD=1-6%ISR=105-10F%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4W2NSNN%O2=M578W2NSNN%O3=M280W2N%O4=M5B4W2NSNN%O5=M218W2NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W2NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell Open Enterprise Server (NW6.5) SP3 - Running Bordermanager 3.8 SP4
Fingerprint Novell NetWare 6.5 SP3 Open Enterprise Server
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5:sp3
SEQ(SP=100-10A%GCD=1-6%ISR=104-10E%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=17FF%W2=17FF%W3=17FF%W4=17FF%W5=17FF%W6=17FF)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=17FF%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell NetWare 6.5 with SP4
Fingerprint Novell NetWare 6.5 SP4
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5:sp4
SEQ(SP=FF-109%GCD=1-6%ISR=108-112%TI=BI%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Novell NetWare 6.5 SP 5
# Novell Open Enterprise Server, Netware 6.5
Fingerprint Novell NetWare 6.5 SP5
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5:sp5
SEQ(SP=FD-10B%GCD=1-6%ISR=108-112%TI=BI|RD|RI%II=BI|RI%SS=S%TS=U)
OPS(O1=M5B4W0NSNN%O2=M578W0NSNN%O3=M280W0N%O4=M5B4W0NSNN%O5=M218W0NSNN%O6=M109SNN)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W0NSNN%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Netware 6.5 SP7
Fingerprint Novell NetWare 6.5 SP7
Class Novell | NetWare | 6.X | general purpose
CPE cpe:/o:novell:netware:6.5:sp7
SEQ(SP=101-10B%GCD=1-6%ISR=103-10D%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4W2N%O2=M578W2N%O3=M280W2N%O4=M5B4W2N%O5=M218W2N%O6=M109)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=1800%O=M5B4W2N%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Noxon Digital radio., http://www.terratec.net
Fingerprint NOXON digital radio
Class NOXON | embedded || media device
SEQ(SP=0-5%GCD=1F7D15|3EFA2A|5E773F|7DF454|9D7169%ISR=BD-C7%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=4000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=2E-38%TG=40%CD=S)

# NRG C7521n printer
Fingerprint NRG C7521n printer
Class NRG | embedded || printer
CPE cpe:/h:nrg:c7521n auto
SEQ(SP=CC-DC%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# MP2500 multifunction printer
Fingerprint NRG MP 2500 printer
Class NRG | embedded || printer
CPE cpe:/h:nrg:mp_2500 auto
SEQ(SP=CA-D4%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M550NW0NNT11%O2=M550NW0NNT11%O3=M550NW0NNT11%O4=M550NW0NNT11%O5=M550NW0NNT11%O6=M550NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M550NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# NRG MP C 4500 printer/multifunction
Fingerprint NRG MP C4500 printer
Class NRG | embedded || printer
CPE cpe:/h:nrg:mp_c4500 auto
SEQ(SP=D0-DC%GCD=1-6%ISR=D7-E1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# NSFOCUS WAF
Fingerprint NSFOCUS WAF
Class NSFOCUS | embedded || security-misc
SEQ(SP=CD-D7%GCD=1-6%ISR=EA-F4%TI=Z%II=I%TS=U)
OPS(O1=M5B4NNS%O2=M5B4NNS%O3=M5B4%O4=M5B4NNS%O5=M5B4NNS%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Device is a NTI Enviromux-Mini at firmware version 1.38 http://www.networktechinc.com/enviro-mini.html
Fingerprint NTI Enviromux-Mini environmental monitoring appliance
Class NTI | embedded || specialized
SEQ(SP=0-5%GCD=388|710|A98|E20|11A8%ISR=64-6E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=N%T=100%TG=FF%W=1800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=100%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=100%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=100%TG=FF%W=1800%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=100%TG=FF%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=100%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=100%TG=FF%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=100%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=100%TG=FF%IPL=38%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=100%TG=FF%CD=Z)

# NTT(Japan) RV-230NE. FTTH router.
Fingerprint NTT RV-230NE router
Class NTT | embedded || router
CPE cpe:/h:ntt:rv-230ne auto
SEQ(SP=C9-D3%GCD=1-6%ISR=D7-E1%TI=RD%CI=RD%II=RI%TS=U)
OPS(O1=M557%O2=M557%O3=M557%O4=M557%O5=M557%O6=M557)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M557%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M557%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# NEC RV230-NE.
Fingerprint NTT RV-230NE router
Class NTT | embedded || router
CPE cpe:/h:ntt:rv-230ne auto
SEQ(SP=D2-DC%GCD=1-6%ISR=D6-E0%TI=RD%CI=RD%II=RI%TS=U)
OPS(O1=M7FD8%O2=M7FD8%O3=M7FD8%O4=M7FD8%O5=M7FD8%O6=M7FD8)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M7FD8%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M7FD8%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# The Nut/OS 4.3.2 beta operating system from Egnite, running on an ARM AT91SAM7X evaluation kit board with the HTTP server demo app. (Web site: http://www.ethernut.de/)
Fingerprint Nut/OS 4.3.2 beta (ARM)
Class Nut/OS | Nut/OS | 4.X | general purpose
CPE cpe:/o:ethernut:nut_os:4.3.2 auto
SEQ(SP=0-5%GCD=1-6%ISR=14-1E%TI=I%II=I%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=C90%W2=C90%W3=C90%W4=C90%W5=C90%W6=C90)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=C90%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=C90%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Obihai OBi110 Firmware version: 1.1.0 (Build: 1890)
Fingerprint Obihai OBi110 VoIP adapter
Class Obihai | embedded || VoIP adapter
CPE cpe:/h:obihai:obi110 auto
SEQ(SP=F3-10D%GCD=1-6%ISR=103-111%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=3E80%O=M5AC%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
T3(R=Y%DF=N%T=1B-25%TG=20%W=3E80%S=O%A=S+%F=AS%O=M5AC%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=ARF%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=1B-25%TG=20%CD=S)

# FreeRTOS and lwip (filtered from binary)
Fingerprint Ocean Signal E101V emergency beacon (FreeRTOS/lwIP)
Class Ocean Signal | embedded || specialized
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=F-19%GCD=1-6%ISR=10-1A%TI=I|RD%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=B68%W2=B68%W3=B68%W4=B68%W5=B68%W6=B68)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=B68%O=M5B4%CC=N)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=O%A=S+%F=AS%O=M5B4%RD=0)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S+%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Oki Model number B4545
Fingerprint Oki B4545 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:b4545 auto
SEQ(SP=FA-106%GCD=1-6%ISR=103-10D%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1388%W2=1388%W3=1388%W4=1388%W5=1388%W6=1388)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1388%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1388%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Oki B711
Fingerprint Oki B711 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:b711 auto
SEQ(SP=83-8D%GCD=1-6%ISR=88-92%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=37-41%TG=40%W=5B4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# OKI B930
Fingerprint Oki B930 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:b930 auto
SEQ(SP=85-8F%GCD=1-6%ISR=88-92%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=37-41%TG=40%W=5B4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# OKI Printing Solutions C5510 MFP
Fingerprint Oki C5510 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:c5510 auto
SEQ(SP=76-8E%GCD=1-6%ISR=98-A2%TI=I)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(R=N)

# OKI C801 Network Firmware 01.08
Fingerprint OKI C801 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:c801 auto
SEQ(SP=FB-105%GCD=1-6%ISR=FB-105%TI=I%II=I%SS=S%TS=6)
OPS(O1=M4C2NW0NNT11%O2=M4C2NW0NNT11%O3=M4C2NW0NNT11%O4=M4C2NW0NNT11%O5=M4C2NW0NNT11%O6=M4C2NNT11)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M4C2NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ES8473 MFP
Fingerprint Oki ES8473 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:es8473 auto
SEQ(SP=97-A1%GCD=1-6%ISR=94-9E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=8000%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# MC342
Fingerprint Oki MC342 printer
Class Oki | embedded || printer
CPE cpe:/h:oki:mc342 auto
SEQ(SP=F9-103%GCD=1-6%ISR=FD-107%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# OKI Network Printer OKI-C5600-340179
# OKI printer, model C5650
# OKI ES8460 MFP CU Version 04.70  PU Version 00.06.07  SIP Version 04.23
# OKI ES3640a3
# OKI B430dn
# Oki MC361
# Oki B431
Fingerprint Oki network printer
Class Oki | embedded || printer
SEQ(SP=F7-109%GCD=1-6%ISR=FF-111%TI=I%CI=I%II=I%SS=S%TS=5|6)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=8000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3A-44%TG=40%W=8000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3A-44%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3A-44%TG=40%CD=S)

# Olympus Stylus SH-2 camera
Fingerprint Olympus Stylus SH-2 camera
Class Olympus | embedded || webcam
CPE cpe:/h:olympus:stylus_sh-2
SEQ(SP=CB-D7%GCD=1-6%ISR=D6-E0%TI=I%CI=I%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=7918%W2=7918%W3=7918%W4=7918%W5=7918%W6=7918)
ECN(R=Y%DF=N%T=77-81%TG=80%W=7918%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=77-81%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=77-81%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=77-81%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=77-81%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=77-81%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=77-81%TG=80%IPL=240%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=82A3%RUD=I)
IE(DFI=N%T=77-81%TG=80%CD=Z)

# Omron CJ2M
Fingerprint Omron CJ2M PLC
Class Omron | embedded || specialized
CPE cpe:/h:omron:cj2m
SEQ(SP=F-19%GCD=7D00|FA00|17700|1F400|27100%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Omron CJ2M-EIP21 PLC
Fingerprint Omron CJ2M PLC
Class Omron | embedded || specialized
CPE cpe:/h:omron:cj2m
SEQ(SP=F-19%GCD=7D00|FA00|17700|1F400|27100%ISR=97-A1%TI=I|RD%CI=I%II=I%SS=O%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OMRON CP1W-CIF41
Fingerprint Omron CP1W-CIF41 PLC Ethernet Module
Class Omron | embedded || specialized
SEQ(SP=8B-95%GCD=3|6|9|C|F%ISR=97-A1%TI=I%CI=I%TS=U)
OPS(O1=M40C%O2=M40C%O3=M40C%O4=M40C%O5=M40C%O6=M40C)
WIN(W1=40C%W2=40C%W3=40C%W4=40C%W5=40C%W6=40C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=40C%O=M40C%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=40C%S=A%A=S+%F=R%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=40C%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=40C%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=40C%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=40C%S=A%A=S+%F=R%O=%RD=0%Q=)
U1(R=N)
IE(R=N)

# Omron CS1H Programmable logic controller Ethernet Module CS1W-ETN21
Fingerprint Omron CS1W-ETN21 PLC Ethernet Module
Class Omron | embedded || specialized
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OMRON OPEN NETWORK CONTROLLER ITNC-EIS01. Welcome to QNX 4.25 Copyright (c) QNX Software Systems Ltd. 1982,1998
Fingerprint Omron ITNV-EIS01 automation controller (QNX RTOS 4.25)
Class Omron | embedded || specialized
CPE cpe:/h:omron:itnc-eis01
Class QNX | RTOS | 4.X | specialized
CPE cpe:/o:qnx:rtos:4.25 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1C84%W2=1B58%W3=1E00%W4=2000%W5=1F68%W6=1F0E)
ECN(R=Y%DF=N%T=37-41%TG=40%W=1C84%O=M5B4%CC=N)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=1F0E%S=O%A=O%F=A%RD=0)
T4(R=Y%DF=N%T=37-41%TG=40%W=2000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Omron NE1A Safety PLC.
Fingerprint Omron NE1A Safety PLC
Class Omron | embedded || specialized
CPE cpe:/h:omron:ne1a
SEQ(SP=F-19%GCD=7D00|FA00|17700|1F400|27100%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1800%W2=1800%W3=1800%W4=1800%W5=1800%W6=1800)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1800%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1800%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=1800%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

#  bootsector of the disk image: .........On Time RTOS-32 3.0 Disk Loader (c) 1996,2000 On Time Informatik GmbH.. (QEMU/KVM)
Fingerprint On Time RTOS-32 3.0
Class On Time | RTOS | 3.X | specialized
CPE cpe:/o:ontime:rtos:3 auto
SEQ(SP=0-5%GCD=1-6%ISR=16-20%II=I%TS=A)
OPS(O1=M5B4T11NN%O2=M5B4T11NN%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4T11NN%O6=M5B4T11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%O=M5B4T11NN%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-3D%TG=40%CD=Z)

# OnTime RTOS
Fingerprint On Time RTOS
Class On Time | RTOS || specialized
CPE cpe:/o:ontime:rtos auto
SEQ(SP=30-52%GCD=1000|2000|3000|4000|5000%ISR=94-AC%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4T11NN%O2=M5B4%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-3D%TG=40%CD=Z)

# Telindus OneAccess 1641
Fingerprint OneAccess 1641 router
Class OneAccess | embedded || broadband router
CPE cpe:/h:oneaccess:1641 auto
SEQ(CI=I|RD%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=1000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F9-103%TG=FF%W=1000%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=F9-103%TG=FF%W=1000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OneAccess One20 ADSL router (On UK LLU ADSL Line) From Internet (ADSL) side
Fingerprint OneAccess ONE20 ADSL router
Class OneAccess | embedded || broadband router
CPE cpe:/h:oneaccess:one20 auto
SEQ(SP=0-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# OneAccess One20 ADSL Router (UK LLU ADSL) From Ethernet side.
Fingerprint OneAccess ONE20 ADSL router
Class OneAccess | embedded || broadband router
CPE cpe:/h:oneaccess:one20 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# OpenBox S10 STB - http://www.wydvb.com
Fingerprint OpenBox S10 set-top box
Class OpenBox | embedded || media device
CPE cpe:/h:openbox:s10
SEQ(SP=4C-6A%GCD=1-6%ISR=B7-C1%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=4000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 2.9 GENERIC#653 i386
Fingerprint OpenBSD 2.9 (x86)
Class OpenBSD | OpenBSD | 2.X | general purpose
CPE cpe:/o:openbsd:openbsd:2.9
SEQ(SP=FC-106%GCD=1-6%ISR=FF-10D%TI=RD%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4000%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# uname -a = "OpenBSD <hostname> 2.8 BOBCAT#1 pmonmips"; Appliance = ONStor Bobcat 2220 NAS Gateway; Firmware = 1.3.3.5;
Fingerprint ONStor Bobcat 2220 NAS Gateway (runs OpenBSD 2.8)
Class OpenBSD | OpenBSD | 2.X | storage-misc
CPE cpe:/o:openbsd:openbsd:2.8 auto
Class OnStor | embedded || storage-misc
CPE cpe:/h:onstor:bobcat_2220
SEQ(SP=86-A0%GCD=1-6%ISR=98-A2%TI=RD%II=RI%TS=1)
OPS(O1=M200NNSNW0NNT11%O2=M200NNSNW0NNT11%O3=M200NW0NNT11%O4=M200NNSNW0NNT11%O5=M200NNSNW0NNT11%O6=M200NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M200NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M200NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=7A89%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.2 GENERIC#25 i386
Fingerprint OpenBSD 3.2 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.2
SEQ(SP=EC-100%GCD=1-6%ISR=E2-10E%TI=RD%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4000%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.3 GENERIC#25 i386
Fingerprint OpenBSD 3.3
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.3
SEQ(SP=F6-108%GCD=1-6%ISR=FF-10B%TI=RD%CI=RI%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4000%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.4 GENERIC#18 i386     Device acting like firewall       pf version
Fingerprint OpenBSD 3.4 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.4
SEQ(SP=F9-FF%GCD=1-6%ISR=100-107%TI=RD%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4000%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.5 GENERIC#34 i386
Fingerprint OpenBSD 3.5
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.5
SEQ(SP=FE-108%GCD=1-6%ISR=103-10D%TI=RD%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.6 GENERIC.MP#173 i386
Fingerprint OpenBSD 3.6 (x86)
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.6
SEQ(SP=F8-104%GCD=1-6%ISR=FF-109%TI=RD%II=RI%TS=1)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.8 GENERIC#138 i386
# OpenBSD 4.6 GENERIC#58 i386
Fingerprint OpenBSD 3.8 - 4.6
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3 auto
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=FC-106%GCD=1-6%ISR=FE-10E%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.1 GENERIC#1435 i386 (box acting as a router/traffic shaper.)
# OpenBSD 4.7 GENERIC.MP#130 amd64
# OpenBSD 3.8 GENERIC#138 i386
Fingerprint OpenBSD 3.8 - 4.7
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3 auto
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=F4-108%GCD=1-6%ISR=FA-112%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.9 GENERIC#3 i386 (pf and packet scrubbing turned off)
Fingerprint OpenBSD 3.9
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.9
SEQ(SP=101-10B%GCD=1-6%ISR=102-10C%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.9 GENERIC#0 i386
Fingerprint OpenBSD 3.9
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3.9
SEQ(SP=F3-FD%GCD=1-6%ISR=FB-105%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.0 sparc64
# OpenBSD 4.1 GENERIC#1435 i386
# OpenBSD 4.2 GENERIC#14 i386
# OpenBSD 3.9 GENERIC#617 i386 (Running pf with scrub in all)
Fingerprint OpenBSD 3.9 - 4.2
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3 auto
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=E5-109%GCD=1-6%ISR=FF-10B%TI=RD%II=I%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 3.9 GENERIC#759 sparc64 , Sun Ultra 5, UltraSPARC-IIi
# OpenBSD 3.9-stable (GENERIC) #0: Tue Aug 29 06:52:40 CDT 2006 (i386)
# OpenBSD 4.0 GENERIC#953 sparc64 SUNW,UltraSPARC-II @ 295.998 MHz, version 0 FPU
# OpenBSD 4.2 GENERIC#375 i386 (VMWare)
# OpenBSD 4.3 GENERIC#698 i386
# OpenBSD 4.4 GENERIC#1 i386
Fingerprint OpenBSD 3.9 - 4.4
Class OpenBSD | OpenBSD | 3.X | general purpose
CPE cpe:/o:openbsd:openbsd:3 auto
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=CB-10C%GCD=1-6%ISR=FA-110%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 i386, GeNUGate Firewall 7.0 Patchlevel 3
Fingerprint Genua GeNUGate Firewall 7.0 (OpenBSD 4.6)
Class OpenBSD | OpenBSD | 4.X | firewall
CPE cpe:/o:openbsd:openbsd:4.6 auto
Class Genua | embedded || firewall
CPE cpe:/h:genua:genugate
SEQ(SP=100-10A%GCD=1-6%ISR=F6-110%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.0-current (GENERIC) #1349: Tue Jan 16 16:55:56 MST 2007
Fingerprint OpenBSD 4.0
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.0
SEQ(SP=FA-108%GCD=1-6%ISR=FE-110%TI=RD%CI=RI%II=RI%TS=20|21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OpenBSD 4.0 POSTERN#0 i386
Fingerprint OpenBSD 4.0
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.0
SEQ(SP=F9-103%GCD=1-6%ISR=FE-108%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.0 GENERIC#1107 i386
Fingerprint OpenBSD 4.0
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.0
SEQ(SP=F4-104%GCD=1-6%ISR=F9-107%TI=RD%II=I%TS=20-22)
OPS(R=N)
WIN(R=N)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M578NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(R=N)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.0 (x86)
Fingerprint OpenBSD 4.0 (x86)
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.0
SEQ(SP=F3-106%GCD=1-6%ISR=100-10A%TI=RD%II=RI%TS=20-22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.0 GENERIC#1107 i386
Fingerprint OpenBSD 4.0 (x86)
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.0
SEQ(SP=FE-108%GCD=1-6%ISR=102-10C%TI=RD%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# miniKabuki router developed by Computer Net Solutions running OpenBSD 4.1 NET4801#0 i386 on a Soekris 4801
Fingerprint OpenBSD 4.1
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.1
SEQ(SP=100-10A%GCD=1-6%ISR=103-10D%TI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.1 GENERIC#1435 i386
Fingerprint OpenBSD 4.1
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.1
SEQ(SP=100-10A%GCD=1-6%ISR=103-10D%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.1 GENERIC#1435 i386
Fingerprint OpenBSD 4.1
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.1
SEQ(SP=F7-101%GCD=1-6%ISR=FC-106%TI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.1 NET4801#1 i386
Fingerprint OpenBSD 4.1 (x86)
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.1
SEQ(SP=FE-108%GCD=1-6%ISR=FE-108%TI=RD%TS=22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.2 GENERIC#375 i386
# OpenBSD 4.1 GENERIC#0 i386
# OpenBSD 4.3 GENERIC#698 i386
# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.1 - 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=100-10C%GCD=1-6%ISR=103-10F%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.2 running on Soekris 4801 acting as firewall/gateway
Fingerprint OpenBSD 4.2
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.2
SEQ(SP=F8-102%GCD=1-6%ISR=102-10C%TI=RD%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.2 GENERIC#0 i386
Fingerprint OpenBSD 4.2
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.2
SEQ(SP=FD-107%GCD=1-6%ISR=107-111%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.2 GENERIC.MP#252 i386
Fingerprint OpenBSD 4.2
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.2
SEQ(SP=100-10A%GCD=1-6%ISR=101-10F%TI=RD%TS=21)
OPS(O1=M8190NNSNW0NNT11%O2=M8190NNSNW0NNT11%O3=M8190NW0NNT11%O4=M8190NNSNW0NNT11%O5=M8190NNSNW0NNT11%O6=M8190NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M8190NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=O|S+%F=AS%O=M8190NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.2 GENERIC#375 i386
# OpenBSD 4.4 GENERIC amd64
Fingerprint OpenBSD 4.2 - 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=FE-10D%GCD=1-6%ISR=104-110%TI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 custom#6 amd64
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=FD-107%GCD=1-6%ISR=107-111%TI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=F5-FF%GCD=1-6%ISR=104-10E%TI=RD%TS=20)
OPS(R=N)
WIN(R=N)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=FA-104%GCD=1-6%ISR=103-10D%TI=RD%TS=21)
OPS(R=N)
WIN(R=N)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=F9-105%GCD=1-6%ISR=105-10F%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=FE-108%GCD=1-6%ISR=100-10E%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=80%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T3(R=Y%DF=N%T=1B-25%TG=20%W=100%S=A%A=Z%F=R%O=%RD=9C2E7B31%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=400%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=8000%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC.MP#587 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=F5-10B%GCD=1-6%ISR=107-111%TI=RD%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=5F-69%TG=80%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=5F-69%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=5F-69%TG=80%W=4000%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=250-25A%TG=FF%IPL=38%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=250-25A%TG=FF%CD=S)

# OpenBSD zaurus 4.3 GENERIC#207 zaurus
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=FF-109%GCD=1-6%ISR=103-10D%TI=RD%II=RI%TS=21|22)
OPS(O1=M4D8NNSNW0NNT11%O2=M4D8NNSNW0NNT11%O3=M4D8NW0NNT11%O4=M4D8NNSNW0NNT11%O5=M4D8NNSNW0NNT11%O6=M4D8NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M4D8NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M4D8NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.3 GENERIC.MP#587 i386
# OpenBSD 4.3 GENERIC#698 i386
Fingerprint OpenBSD 4.3
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.3
SEQ(SP=FC-106%GCD=1-6%ISR=104-10E%TI=RD%CI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#968 i386
Fingerprint OpenBSD 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(SP=F3-109%GCD=1-6%ISR=FC-114%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#1021 i386
Fingerprint OpenBSD 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(R=N)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#1021 i386
Fingerprint OpenBSD 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(SP=101-10D%GCD=1-6%ISR=109-113%TI=RD%II=RI%TS=21|22)
OPS(O1=M578NNSNW0NNT11%O2=M578NNSNW0NNT11%O3=M578NW0NNT11%O4=M578NNSNW0NNT11%O5=M578NNSNW0NNT11%O6=M578NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M578NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#1021 i386
Fingerprint OpenBSD 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(SP=FA-108%GCD=1-6%ISR=107-113%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=80%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T3(R=N)
T4(R=Y%DF=N%T=1B-25%TG=20%W=400%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=8000%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 NET45xx#0 i386
Fingerprint OpenBSD 4.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(SP=FB-109%GCD=1-6%ISR=104-10E%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#1021 i386
# OpenBSD 4.5 GENERIC#1749 i386
Fingerprint OpenBSD 4.4 - 4.5
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.4
SEQ(SP=EE-108%GCD=1-6%ISR=F9-111%TI=RD%CI=RI%II=RI%TS=20-22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.4 GENERIC#1021 i386
# OpenBSD 4.6 KINTARO#0 i386
Fingerprint OpenBSD 4.4 - 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
SEQ(SP=F9-107%GCD=1-6%ISR=FF-10B%TI=RD%CI=RD%II=RI%TS=20)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=O|S+%F=AS%O=M5B4NNSNW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.5 GENERIC#1749 i386
Fingerprint OpenBSD 4.5
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.5
SEQ(SP=FF-109%GCD=1-6%ISR=106-112%TI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.5 GENERIC#1749 i386
Fingerprint OpenBSD 4.5
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.5
SEQ(SP=F8-102%GCD=1-6%ISR=108-112%TI=RD%CI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.5 GENERIC#1749 i386
Fingerprint OpenBSD 4.5
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.5 auto
SEQ(SP=FD-107%GCD=1-6%ISR=105-10F%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 GENERIC#53 amd64
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 GENERIC#58 i386
# OpenBSD 4.6 GENERIC#58 i386, match in all scrub (no-df)
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6
SEQ(SP=100-10A%GCD=1-6%ISR=102-10C%TI=RD%CI=RI%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 GENERIC#58 i386
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6
SEQ(SP=100-10A%GCD=1-6%ISR=105-10F%TI=RD%CI=RI%II=RI%TS=U)
OPS(O1=M535%O2=M535%O3=M280%O4=M200%O5=M218%O6=M109)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=0%O=M535%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 GENERIC#0 i386
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6
SEQ(SP=101-10B%GCD=1-6%ISR=107-111%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.6 GENERIC#58 i386
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6
SEQ(SP=F9-109%GCD=1-6%ISR=105-10F%TI=RD%CI=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OpenBSD 4.6 GENERIC#58 i386
Fingerprint OpenBSD 4.6
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.6 auto
SEQ(SP=FE-108%GCD=1-6%ISR=105-10F%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.7 GENERIC#558 i386
Fingerprint OpenBSD 4.7
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.7
SEQ(SP=FD-107%GCD=1-6%ISR=100-110%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M558NNSNW0NNT11%O2=M558NNSNW0NNT11%O3=M558NW0NNT11%O4=M558NNSNW0NNT11%O5=M558NNSNW0NNT11%O6=M558NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M558NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.7 GENERIC#558 i386
Fingerprint OpenBSD 4.7
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.7
SEQ(SP=100-10C%GCD=1-6%ISR=103-10D%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW0NNT11%O2=M5B4NNSNW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NNSNW0NNT11%O5=M5B4NNSNW0NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.8 GENERIC#0 i386
Fingerprint OpenBSD 4.8
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.8
SEQ(SP=FD-107%GCD=1-6%ISR=107-111%TI=RD%II=RI%TS=21)
OPS(O1=M5C0NNSNW3NNT11%O2=M5C0NNSNW3NNT11%O3=M5C0NW3NNT11%O4=M5C0NNSNW3NNT11%O5=M5C0NNSNW3NNT11%O6=M5C0NNSNNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M5C0NNSNW3%CC=Y%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 4.9 GENERIC#671 i386
Fingerprint OpenBSD 4.9
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4.9 auto
SEQ(SP=FA-108%GCD=1-6%ISR=102-112%TI=RD%CI=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OpenBSD 4.9 Grsec#671 i386
# OpenBSD 4.9 GENERIC.MP#794 i386
# OpenBSD 5.0 GENERIC#53 amd64
# OpenBSD 4.9 i386, GeNUGate 7.1 Patchlevel 0
# OpenBSD 5.1 guest on VMware Workstation 7.1.5
Fingerprint OpenBSD 4.9 - 5.1
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:4
SEQ(SP=F7-109%GCD=1-6%ISR=FF-113%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.3 GENERIC#76 loongson
# OpenBSD 4.9 GENERIC#671 i386
# OpenBSD 5.4
Fingerprint OpenBSD 4.9 - 5.4
Class OpenBSD | OpenBSD | 4.X | general purpose
CPE cpe:/o:openbsd:openbsd:4 auto
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5 auto
SEQ(SP=FC-107%GCD=1-6%ISR=106-116%TI=RD%CI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.0 GENERIC.MP#0 amd64
Fingerprint OpenBSD 5.0
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.0 auto
SEQ(SP=100-10A%GCD=1-6%ISR=108-112%TI=RD%CI=RI%II=RI%TS=21)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.0 GENERIC#43 i386
# OpenBSD 5.5 GENERIC#264 i386
# OpenBSD 5.7 GENERIC.MP#0 amd64
# OpenBSD 5.8
Fingerprint OpenBSD 5.0 - 5.8
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5 auto
SEQ(SP=F8-10A%GCD=1-6%ISR=FA-114%TI=RD%CI=RI%II=RI%TS=20-22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.0 GENERIC#43 i386
# OpenBSD 5.0 GENERIC.MP#59 i386
# OpenBSD 5.3 GENERIC#53 amd64
# OpenBSD 5.4 GENERIC.MP#41 amd64
# OpenBSD 6.0 amd64
Fingerprint OpenBSD 5.0 - 6.0
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5 auto
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6 auto
SEQ(SP=F5-10D%GCD=1-6%ISR=103-10F%TI=RD%II=RI%TS=20-22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.1-stable (i386)
Fingerprint OpenBSD 5.1
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.1
SEQ(SP=100-10A%GCD=1-6%ISR=103-10D%TI=RD%CI=RI%II=RI%TS=22)
OPS(O1=M578NNSNW3NNT11%O2=M578NNSNW3NNT11%O3=M578NW3NNT11%O4=M578NNSNW3NNT11%O5=M578NNSNW3NNT11%O6=M578NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M578NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.2 GENERIC.MP#1 amd64
Fingerprint OpenBSD 5.2
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.2 auto
SEQ(SP=FA-104%GCD=1-6%ISR=108-112%TI=RD%CI=RD%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.2 GENERIC#278 i386
Fingerprint OpenBSD 5.2
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.2 auto
SEQ(SP=FA-108%GCD=1-6%ISR=100-112%TI=RD%CI=RI%II=RI%TS=20-22)
OPS(O1=M558NNSNW3NNT11%O2=M558NNSNW3NNT11%O3=M558NW3NNT11%O4=M558NNSNW3NNT11%O5=M558NNSNW3NNT11%O6=M558NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M558NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.2 GENERIC#278 i386
# OpenBSD 5.3 GENERIC#116 i386
Fingerprint OpenBSD 5.2 - 5.3
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5 auto
SEQ(SP=FB-105%GCD=1-6%ISR=105-10F%TI=RD%CI=RD%TS=21)
OPS(O1=M8184NNSNW3NNT11%O2=M8184NNSNW3NNT11%O3=M8184NW3NNT11%O4=M8184NNSNW3NNT11%O5=M8184NNSNW3NNT11%O6=M8184NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M8184NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M8184NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.3 GENERIC#50 i386
Fingerprint OpenBSD 5.3
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.3 auto
SEQ(SP=102-10C%GCD=1-6%ISR=108-112%TI=RD%II=RI%TS=20-22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.3 GENERIC#50 i386
Fingerprint OpenBSD 5.3
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.3 auto
SEQ(SP=FE-108%GCD=2|4|6|8|A%ISR=108-112%TI=RD%CI=RI%II=RI%TS=21)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# localhost scan
# OpenBSD 5.4 GENERIC#37 i386
Fingerprint OpenBSD 5.4
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.4 auto
SEQ(SP=FE-108%GCD=1-6%ISR=107-111%TI=RD%CI=RD%TS=21|22)
OPS(O1=M8180NNSNW3NNT11%O2=M8180NNSNW3NNT11%O3=M8180NW3NNT11%O4=M8180NNSNW3NNT11%O5=M8180NNSNW3NNT11%O6=M8180NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M8180NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M8180NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.5 GENERIC.MP#315 amd64
Fingerprint OpenBSD 5.5
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.5 auto
SEQ(SP=102-10C%GCD=1-6%ISR=107-111%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4896%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.5 GENERIC.MP#290 amd64
Fingerprint OpenBSD 5.5
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.5 auto
SEQ(SP=101-10B%GCD=1-6%ISR=106-110%TI=RD%CI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.5 GENERIC.MP#315 amd64
Fingerprint OpenBSD 5.5
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.5 auto
SEQ(SP=FE-108%GCD=1-6%ISR=100-10A%TI=RD%CI=RI%II=RI%TS=22)
OPS(O1=M59CNNSNW3NNT11%O2=M59CNNSNW3NNT11%O3=M59CNW3NNT11%O4=M59CNNSNW3NNT11%O5=M59CNNSNW3NNT11%O6=M59CNNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M59CNNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.5 GENERIC.MP#262 i386
Fingerprint OpenBSD 5.5
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.5 auto
SEQ(SP=FD-107%GCD=1-6%ISR=108-112%TI=RD%CI=RI%II=RI%TS=21)
OPS(O1=M536NNSNW3NNT11%O2=M536NNSNW3NNT11%O3=M536NW3NNT11%O4=M536NNSNW3NNT11%O5=M536NNSNW3NNT11%O6=M536NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M536NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# localhost scan
# OpenBSD 5.6 GENERIC#274 i386
# OpenBSD 5.8 GENERIC.MP#1236 amd64
Fingerprint OpenBSD 5.6 - 5.8
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5 auto
SEQ(SP=100-10A%GCD=1-6%ISR=107-111%TI=RD%CI=RD%II=RI%TS=21)
OPS(O1=M7FD8NNSNW3NNT11%O2=M7FD8NNSNW3NNT11%O3=M7FD8NW3NNT11%O4=M7FD8NNSNW3NNT11%O5=M7FD8NNSNW3NNT11%O6=M7FD8NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M7FD8NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M7FD8NNSNW3NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.8 GENERIC#651 macppc
Fingerprint OpenBSD 5.8
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.8 auto
SEQ(SP=104-10E%GCD=1-6%ISR=105-10F%TI=RD%CI=RI%II=RI%TS=20)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.8 GENERIC.MP#0 amd64
Fingerprint OpenBSD 5.8
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.8 auto
SEQ(SP=100-10A%GCD=1-6%ISR=105-10F%TI=RD%CI=I|RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.9 GENERIC.MP#1888 amd64
Fingerprint OpenBSD 5.9
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.9 auto
SEQ(SP=FC-106%GCD=1-6%ISR=102-110%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.9 GENERIC#1761 amd64
Fingerprint OpenBSD 5.9
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.9 auto
SEQ(SP=FE-108%GCD=1-6%ISR=101-10B%TI=RD%CI=RI%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M200%O5=M218%O6=M109)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 5.9 GENERIC.MP#8 amd64
Fingerprint OpenBSD 5.9
Class OpenBSD | OpenBSD | 5.X | general purpose
CPE cpe:/o:openbsd:openbsd:5.9 auto
SEQ(SP=FF-109%GCD=1-6%ISR=105-10F%TI=RD%TS=22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=4000%O=M5B4NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OpenBSD 6.0 GENERIC#0 i386
# OpenBSD 6.0 GENERIC.MP#13 (TS=22)
Fingerprint OpenBSD 6.0
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.0 auto
SEQ(SP=FE-108%GCD=1-6%ISR=104-10E%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5A0NNSNW3NNT11%O2=M5A0NNSNW3NNT11%O3=M5A0NW3NNT11%O4=M5A0NNSNW3NNT11%O5=M5A0NNSNW3NNT11%O6=M5A0NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5A0NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.0 GENERIC.MP#0 amd64 [match in on lan scrub (random-id reassemble tcp)]
Fingerprint OpenBSD 6.0
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.0 auto
SEQ(SP=FF-10B%GCD=1-6%ISR=103-10D%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=D8D0%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.0 GENERIC#2148 amd64
Fingerprint OpenBSD 6.0
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.0 auto
SEQ(SP=102-10C%GCD=1-6%ISR=106-110%TI=RD%CI=RI%II=RI%TS=21)
OPS(O1=M5B4NNSNW3NNT11%O2=M5B4NNSNW3NNT11%O3=M5B4NW3NNT11%O4=M5B4NNSNW3NNT11%O5=M5B4NNSNW3NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=53C2%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.0 GENERIC#0 i386
# OpenBSD 6.1 GENERIC.MP#20 amd64
# OpenBSD 6.1 GENERIC.MP#81 sparc64
# OpenBSD 6.1 GENERIC.MP#20 amd64
# OpenBSD 6.2
# OpenBSD 6.3 GENERIC#100 amd64
# OpenBSD 6.4 GENERIC#264 alpha
Fingerprint OpenBSD 6.0 - 6.4
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6 auto
SEQ(SP=F7-10B%GCD=1-6%ISR=102-10E%TI=RD%CI=RI%II=RI%TS=21|22)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.1 GENERIC.MP#37 amd64
Fingerprint OpenBSD 6.1
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.1 auto
SEQ(SP=103-10D%GCD=1-6%ISR=105-10F%TI=RD%CI=RI%II=RI%TS=22)
OPS(O1=M562NNSNW6NNT11%O2=M562NNSNW6NNT11%O3=M562NW6NNT11%O4=M562NNSNW6NNT11%O5=M562NNSNW6NNT11%O6=M562NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M562NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.1 GENERIC.MP#20 amd64
Fingerprint OpenBSD 6.1
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.1 auto
SEQ(SP=F7-101%GCD=1-6%ISR=FD-115%TI=RD%CI=RI%II=RI%TS=20|21)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.1 GENERIC.MP#20 amd64
Fingerprint OpenBSD 6.1
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.1 auto
SEQ(SP=FF-109%GCD=1-6%ISR=106-110%TI=RD%CI=RI%II=RI%TS=22)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.1 GENERIC.MP#23 amd64
Fingerprint OpenBSD 6.1
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.1 auto
SEQ(SP=FC-106%GCD=1-6%ISR=106-110%TI=RD%TS=21)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OpenBSD 6.1 localhost
# OpenBSD 6.2
# OpenBSD 6.3 GENERIC.MP#107 amd64
# OpenBSD 6.4 GENERIC#349 amd64
Fingerprint OpenBSD 6.1 - 6.4
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6 auto
SEQ(SP=100-10A%GCD=1-6%ISR=101-113%TI=RD%CI=RD%II=RI%TS=21|22)
OPS(O1=M7FD8NNSNW6NNT11%O2=M7FD8NNSNW6NNT11%O3=M7FD8NW6NNT11%O4=M7FD8NNSNW6NNT11%O5=M7FD8NNSNW6NNT11%O6=M7FD8NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M7FD8NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M7FD8NNSNW6NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.2 GENERIC.MP#134 amd64
Fingerprint OpenBSD 6.2
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.2 auto
SEQ(SP=101-10B%GCD=2|4|6|8|A%ISR=103-10D%TI=RD%TS=21)
OPS(O1=M59CNNSNW6NNT11%O2=M59CNNSNW6NNT11%O3=M59CNW6NNT11%O4=M59CNNSNW6NNT11%O5=M59CNNSNW6NNT11%O6=M59CNNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M59CNNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.2 GENERIC#7 amd64
# OpenBSD 6.4 GENERIC.MP#9 amd64
Fingerprint OpenBSD 6.2 - 6.4
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6 auto
SEQ(SP=FE-108%GCD=1-6%ISR=109-113%TI=RD%II=RI%TS=21)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OpenBSD 6.3 GENERIC.MP#4 amd64
Fingerprint OpenBSD 6.3
Class OpenBSD | OpenBSD | 6.X | general purpose
CPE cpe:/o:openbsd:openbsd:6.3 auto
SEQ(SP=FC-106%GCD=1-6%ISR=108-112%TI=RD%II=RI%TS=22)
OPS(O1=M5B4NNSNW6NNT11%O2=M5B4NNSNW6NNT11%O3=M5B4NW6NNT11%O4=M5B4NNSNW6NNT11%O5=M5B4NNSNW6NNT11%O6=M5B4NNSNNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SNAP PAC Ethernet Brain 2
Fingerprint Opto 22 SNAP-PAC-EB2 I/O controller
Class Opto 22 | embedded || specialized
SEQ(SP=ED-119%GCD=1-6%ISR=103-10D%TI=RI%II=I%TS=U)
OPS(O1=M5B4NW0NNS%O2=M578NW0NNS%O3=M280NW0%O4=M5B4NW0NNS%O5=M218NW0NNS%O6=M109NNS)
WIN(W1=4A24%W2=4C90%W3=4880%W4=4A24%W5=4948%W6=4876)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4A24%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Oracle JRockitVE (JRockit Virtual Edition) on Virtualbox, which is an OSless solution to provide Java Virtual Machine
Fingerprint Oracle JRockit Java virtual machine
Class Oracle | JRockit || general purpose
CPE cpe:/o:oracle:jrockit auto
SEQ(SP=0-2B%GCD=1-6|64|C8|12C|190|1F4%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NWA%O2=M5B4NWA%O3=M5B4NWA%O4=M5B4NWA%O5=M5B4NWA%O6=M5B4NWA)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FFFF%O=M5B4NWA%CC=N%Q=|R)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=|R)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0%Q=R)
T4(R=Y%DF=Y%T=37-41%TG=40%W=0%S=A%A=S%F=R%RD=0%Q=R)
T5(R=Y%DF=Y%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0%Q=R)
T6(R=Y%DF=Y%T=37-41%TG=40%W=0%S=A%A=S%F=R%RD=0%Q=R)
T7(R=Y%DF=Y%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0%Q=R)
U1(DF=Y%T=73-7D%TG=80%IPL=38%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=Y%T=73-7D%TG=80%CD=Z)

# SunOS 5.10 Generic_Virtual sun4v sparc sun4v; Oracle Solaris 10 8/11 s10s_u10wos_17b SPARC
Fingerprint Oracle Solaris 10
Class Oracle | Solaris | 10 | general purpose
CPE cpe:/o:oracle:solaris:10 auto
SEQ(SP=91-9B%GCD=1-6%ISR=A0-AA%TI=I|RD%CI=RD%II=I%SS=S%TS=7|8)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=25-2F%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=27-31%TG=40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=26-30%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=20-2A%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=32-3C%TG=40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS --- 5.10 Generic_Virtual i86pc i386 i86pc
Fingerprint Oracle Solaris 10
Class Oracle | Solaris | 10 | general purpose
CPE cpe:/o:oracle:solaris:10 auto
SEQ(SP=103-10D%GCD=1-6%ISR=102-10C%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW2%O2=ST11M5B4NW2%O3=NNT11M5B4NW2%O4=ST11M5B4NW2%O5=ST11M5B4NW2%O6=ST11M5B4)
WIN(W1=FA4A%W2=FAC3%W3=FA38%W4=FA3B%W5=FA3B%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Oracle Solaris 11.1
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=8E-9C%GCD=1-6%ISR=9E-A8%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Oracle Solaris 11
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=8F-A5%GCD=1-6%ISR=A0-AA%TI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.11 11.1 sun4v sparc sun4v
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=FF-109%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=36-40%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=36-40%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=F9-103%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=F9-103%TG=FF%CD=S)

# Localhost
# P=i386-pc-solaris2.11
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=FC-106%GCD=1-6%ISR=103-10D%TI=Z%CI=Z%II=Z%TS=7)
OPS(O1=ST11M2000NW1%O2=ST11M2000NW1%O3=NNT11M2000NW1%O4=ST11M2000NW1%O5=ST11M2000NW1%O6=ST11M2000)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M2000NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M2000NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.11 11.3 i86pc i386 i86pc
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=100-10A%GCD=1-6%ISR=107-111%TI=I%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Solaris 11
Fingerprint Oracle Solaris 11
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=FB-105%GCD=1-6%ISR=FF-109%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW2%O2=ST11M5B4NW2%O3=NNT11M5B4NW2%O4=ST11M5B4NW2%O5=ST11M5B4NW2%O6=ST11M5B4)
WIN(W1=FA4A%W2=FAC3%W3=FA38%W4=FA3B%W5=FA3B%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS solaris 5.11 11.2 i86pc i386 i86pc
# SunOS openindiana 5.11 illumos-7fc68dd i86pc i386 i86pc
# SunOS openindiana 5.11 illumos-f83b46b i86pc i386 i86pc
Fingerprint Oracle Solaris 11 or OpenIndiana
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
Class illumos | OpenIndiana || general purpose
CPE cpe:/o:illumos:openindiana auto
SEQ(SP=F2-108%GCD=1-6%ISR=FF-111%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.12 i86pc i386 i86pc
Fingerprint Solaris 12
Class Oracle | Solaris | 11 | general purpose
CPE cpe:/o:oracle:solaris:11 auto
SEQ(SP=F8-102%GCD=2|4|6|8|A%ISR=FE-108%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Virtualbox - unknown?
Fingerprint Oracle Virtualbox
Class Oracle | Virtualbox || bridge
CPE cpe:/o:oracle:virtualbox auto
SEQ(SP=D-17%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3C-46%TG=40%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=2E-38%TG=40%IPL=148%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=G%RUD=G)
IE(R=N)

# Oracle VM Server 3.4.2
Fingerprint Oracle VM Server 3.4.2 (Linux 4.1)
Class Oracle | VM Server | 3.X | specialized
CPE cpe:/o:oracle:vm_server:3.4.2 auto
Class Linux | Linux | 4.X | specialized
CPE cpe:/o:linux:linux_kernel:4.1 auto
SEQ(SP=103-10D%GCD=1-6%ISR=105-10F%TI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NWC%O2=M5B4ST11NWC%O3=M5B4NNT11NWC%O4=M5B4ST11NWC%O5=M5B4ST11NWC%O6=M5B4ST11)
WIN(W1=A9B0%W2=A9B0%W3=A9B0%W4=A9B0%W5=A9B0%W6=7120)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=A564%O=M5B4NNSNWC%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Livebox Business (SDSL router from French ISP for professionnal customers Orange Business Services)
Fingerprint Orange Livebox Business wireless DSL router
Class Orange | embedded || WAP
CPE cpe:/h:orange:livebox
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=4801%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# USR/Sagem F@st 334 router (Wanadoo Livebox) (Wikipedia said : VxWorks and tweaked Linux)
# Orange.fr ISP adsl2 modem/router (aka LiveBox)
# Orange Livebox (Home ADSL Router)
Fingerprint Orange Livebox wireless DSL router or Sagem F@st 334 or 3304 DSL router
Class Orange | embedded || WAP
CPE cpe:/h:orange:livebox
Class Sagem Communication | embedded || WAP
CPE cpe:/h:sagem:f%40ast_334
CPE cpe:/h:sagem:f%40ast_3304
SEQ(SP=8E-98%GCD=1-6%ISR=92-9C%TI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# Osmosys Digicorder L21XTLNDGRD v4.11-rc-373-ga82a874
Fingerprint Osmosys DMS DVR
Class Osmosys | embedded || media device
SEQ(SP=BA-C4%GCD=1-6%ISR=C4-CE%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=00-08%TG=20%W=16D0%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=00-08%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=00-08%TG=20%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW6%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# OSRAM Lightify Controller firmware version 1.1.1.24
Fingerprint OSRAM Lightify ZigBee gateway
Class OSRAM | embedded || specialized
CPE cpe:/h:osram:lightify
SEQ(SP=0-5%GCD=154|2A8|3FC|550|6A4%ISR=59-63%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=41A0%W2=41A0%W3=41A0%W4=41A0%W5=41A0%W6=41A0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OSRAM Lightify ZigBee gateway
Fingerprint OSRAM Lightify ZigBee gateway
Class OSRAM | embedded || specialized
CPE cpe:/h:osram:lightify
SEQ(CI=I%II=I|RI%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OSRAM Lightify ZigBee gateway version 1.1.3.41
Fingerprint OSRAM Lightify ZigBee gateway
Class OSRAM | embedded || specialized
CPE cpe:/h:osram:lightify
SEQ(SP=E-18%GCD=1-6%ISR=29-33%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=41A0%W2=41A0%W3=41A0%W4=41A0%W5=41A0%W6=41A0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=41A0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# OUYA game console
Fingerprint OUYA game console
Class Ouya | embedded || game console
SEQ(CI=I%II=I)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=N)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Packard Bell NetStore 3500 network hard drive
Fingerprint Packard Bell NetStore 3500
Class Packard Bell | embedded || storage-misc
SEQ(SP=0-44%GCD=1-6%ISR=71-7B%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=4000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=1B-25%TG=20%W=4000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=1B-25%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=1B-25%TG=20%CD=S)

# Packet8 Broadband Phone Adapter BPA410
Fingerprint Packet8 BPA410 broadband phone adapter
Class Packet8 | embedded || VoIP adapter
SEQ(SP=0-5%GCD=834E00|1069C00|189EA00|20D3800|2908600|5210C00%ISR=E8-F2%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=578%W2=578%W3=578%W4=578%W5=578%W6=578)
ECN(R=N)
T1(R=Y%DF=Y%T=73-7D%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=73-7D%TG=80%W=578%S=O%A=S+%F=AS%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=73-7D%TG=80%W=578%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=73-7D%TG=80%W=578%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=73-7D%TG=80%W=578%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=73-7D%TG=80%W=578%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=73-7D%TG=80%IPL=148%UN=BA4C%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=I)
IE(DFI=Y%T=73-7D%TG=80%CD=Z)

# 8x8 (Packet8) VoIP phone BPA430
Fingerprint Packet8 BPA430 VoIP adapter
Class Packet8 | embedded || VoIP adapter
CPE cpe:/h:packet8:bpa430 auto
SEQ(SP=C-16%GCD=9C4|1388|1D4C|2710|30D4%ISR=5D-67%TI=I%CI=I%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=578%W2=578%W3=578%W4=578%W5=578%W6=578)
ECN(R=Y%DF=N%T=20-3C%TG=40%W=578%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=25-37%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=20-2A|2E-3D%TG=40%W=578%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=21-2C|2F-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=25-40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=20-3E%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# BlueCoat PacketShaper 7500, 8.6.4g1.
Fingerprint Packeteer PacketShaper 7500 firewall
Class Packeteer | embedded || firewall
CPE cpe:/h:packeteer:packetshaper_7500 auto
SEQ(SP=E-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B0%O2=M5B0%O3=M5B0%O4=M5B0%O5=M5B0%O6=M5B0)
WIN(W1=5B0%W2=5B0%W3=5B0%W4=5B0%W5=5B0%W6=5B0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B0%O=M5B0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Packeteer 100 - Packeteer PacketShaper 5.2.0
Fingerprint Packeteer PacketShaper firewall version 5.2.0
Class Packeteer | embedded || firewall
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B0%O2=M5B0%O3=M5B0%O4=M5B0%O5=M5B0%O6=M5B0)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Packeteer Packetshaper 6500/ISP runing 7.3.1g1
Fingerprint Packeteer PacketShaper 6500/ISP
Class Packeteer | embedded || load balancer
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# PacketFront DRG Ease DRG601-Access
Fingerprint PacketFront DRG Ease DRG601-Access switch
Class PacketFront | embedded || switch
CPE cpe:/h:packetfront:drg_ease_drg601-access auto
SEQ(SP=9-13%GCD=9C4|1388|1D4C|2710|30D4%ISR=5A-6C%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=BB8%W2=BB8%W3=BB8%W4=BB8%W5=BB8%W6=BB8)
ECN(R=Y%DF=N%T=23-40%TG=40%W=BB8%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=25-40%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=20-3F%TG=40%W=BB8%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=20-3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=20-3A%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=23-3E%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Palmmicro VoIP phone (model AR1688, running version 0.22 of the firmware
Fingerprint Palmmicro AR1688 VoIP module
Class Palmmicro | embedded || VoIP phone
SEQ(SP=F7-107%GCD=1-6|8|10|18|20|28%ISR=103-113%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=5B4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=7B-85%TG=80%W=5B4%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=7B-85%TG=80%CD=Z)

# Palo Alto Networks PA-500 firewall running v6.0.3.
Fingerprint Palo Alto PA-500 firewall
Class Palo Alto | embedded || firewall
CPE cpe:/h:paloalto:pa-500 auto
SEQ(SP=F7-109%GCD=1-6%ISR=105-10F%TI=Z%CI=RD|RI%II=I%TS=7)
OPS(O1=M514ST11NW7%O2=M514ST11NW7%O3=M514NNT11NW7%O4=M514ST11NW7%O5=M514ST11NW7%O6=M514ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M514NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FB-105%TG=FF%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FB-105%TG=FF%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FB-105%TG=FF%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FB-105%TG=FF%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FB-105%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FB-105%TG=FF%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasas ActiveStor Version 3.0.6.d
Fingerprint Panasas ActiveStor storage device (version 3.0.6.d)
Class Panasas | embedded || storage-misc
SEQ(SP=F2-10A%GCD=1-6%ISR=104-10E%TI=RI%II=I%SS=S%TS=A)
OPS(O1=M5B4NW4NNT11%O2=M5B4NW4NNT11%O3=M5B4NW4NNT11%O4=M5B4NW4NNT11%O5=M5B4NW4NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M5B4NW4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW4NNT11%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Panasonic PT-VZ575 Projector
Fingerprint Panasonic PT-VZ575 projector
Class Panasonic | embedded || media device
CPE cpe:/h:panasonic:pt-vz575
SEQ(SP=FE-108%GCD=1-6%ISR=104-10E%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW4%O2=M5B4ST11NW4%O3=M5B4NNT11NW4%O4=M5B4ST11NW4%O5=M5B4ST11NW4%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW4%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasonic DP-3520 (color laser printer)
# Panasonic DP-3510
Fingerprint Panasonic DB-3500 series printer
Class Panasonic | embedded || printer
CPE cpe:/h:panasonic:db-3510
CPE cpe:/h:panasonic:db-3520
SEQ(SP=B-21%GCD=A|14|1E|28|32|3C%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasonic DP-8045 digital imaging system
Fingerprint Panasonic DP-8045 printer
Class Panasonic | embedded || printer
CPE cpe:/h:panasonic:dp-8045 auto
SEQ(SP=D1-DB%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=S+%F=AS%O=M5B4NW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Panasonic BB-HCM511A, Version 3.51R00
# BL-C140A web cam
Fingerprint Panasonic BB-HCM511A or BL-C140A Network Camera
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:bb-hcm511a
CPE cpe:/h:panasonic:bl-c140
SEQ(SP=CF-D9%GCD=1-6%ISR=D7-E1%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M5B4NW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Panasonic BL-C140 (Version 3.50R00)
Fingerprint Panasonic BL-C140 Network Camera
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:bl-c140
SEQ(SP=CE-DA%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M576NW0NNT01%O2=M576NW0NNT01%O3=M576NW0NNT01%O4=M576NW0NNT01%O5=M576NW0NNT01%O6=M576NNT01)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M576NW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M576NW0NNT01%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Panasonic BL-C140
Fingerprint Panasonic BL-C140 Network Camera
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:bl-c140
SEQ(SP=CB-DD%GCD=1-6%ISR=D6-E0%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M5B4NW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Panasonic webcam - BL-C210
Fingerprint Panasonic BL-C210 Network Camera
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:bl-c210
SEQ(SP=CF-D9%GCD=1-6%ISR=D8-E2%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=|U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=U)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O|S+%F=AS%O=M5B4%RD=0%Q=|U)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasonic BL-C210A IP webcam
Fingerprint Panasonic BL-C210A webcam
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:bl-c210a auto
SEQ(SP=FE-108%GCD=1-6%ISR=105-10F%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M564%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=FB-105%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasonic KX-HCM270, Firmware(Boot) 1.62, Firmware(Application) 1.62
# Symbol Spectrum24 Wireless Access Point
Fingerprint Panasonic KX-HCM270 Network Camera or Symbol Spectrum24 4131 WAP
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:kx-hcm270
Class Symbol | embedded || WAP
CPE cpe:/h:spectrum24_4131
SEQ(SP=0-43%GCD=5|A|F|14|19|64|C8|12C|190|1F4%ISR=40-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Panasonic WV-NS202A
Fingerprint Panasonic WV-NS202A security camera
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:wv-ns202a
SEQ(SP=0-5%GCD=7A120|F4240|16E360|1E8480|2625A0%ISR=AD-B7%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M578NW0%O3=M280NW0%O4=M5B4NW0%O5=M218NW0%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=F3FBE867%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=F3FBE867%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=F3FBE867%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# WV-SP300, WV-SF330
Fingerprint Panasonic WV-SP300 or WV-SF330 webcam
Class Panasonic | embedded || webcam
CPE cpe:/h:panasonic:wv-sp300
CPE cpe:/h:panasonic:wv-sf330
SEQ(SP=CD-D7%GCD=1-6%ISR=D9-E3%II=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=U)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# 'papouch.com' Ethernet IP Thermometer of model type 'TME'
Fingerprint Papouch TME Ethernet thermometer
Class Papouch | embedded || specialized
SEQ(CI=I)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1FF%O=M400%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# TME Ethernet thermometer. TME v 1.6 www.papouch.com
Fingerprint Papouch TME Ethernet thermometer
Class Papouch | embedded || specialized
SEQ(SP=BF-DD%GCD=1-6%ISR=C0-DE%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M400%O2=|M400%O3=|M400%O4=|M400%O5=|M400%O6=|M400)
WIN(W1=0|1FF%W2=0|1FF%W3=0|1FF%W4=0|1FF%W5=0|1FF%W6=0|1FF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=0|1FF%O=|M400%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0|1FF%S=O|Z%A=S+%F=AR|AS%O=|M400%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VoIP-ISDN-Gateway Patton SN4638
Fingerprint Patton SmartNode 4638 VoIP adapter
Class Patton | SmartWare | 4.X | VoIP adapter
CPE cpe:/o:patton:smartware:4 auto
SEQ(SP=0-5%GCD=0%ISR=0-5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Patton/Inalp (www.patton.com) Smartnode 4960 VoIP Gateway. OS is Smartware 4.2.
Fingerprint Patton SmartNode 4960 VoIP adapter (SmartWare 4.2)
Class Patton | SmartWare | 4.X | VoIP adapter
CPE cpe:/o:patton:smartware:4.2 auto
SEQ(SP=0-1D%GCD=0|8000|10000|18000|20000|28000%ISR=0-FB%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S%F=AR%O=%RD=0%Q=U)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S%F=AR%O=%RD=0%Q=U)
U1(DF=N%T=7B-85%TG=80%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# SmartNode 4112 running <smartWare 5.6
Fingerprint Patton SmartNode 4112 VoIP adapter (SmartWare 5.6)
Class Patton | SmartWare | 5.X | VoIP adapter
CPE cpe:/o:patton:smartware:5.6
SEQ(SP=0-5%GCD=0%ISR=0-5%TI=I%CI=I%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=FFFF%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S%F=AR%O=%RD=0%Q=U)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=A%A=Z%F=R%O=%RD=0%Q=U)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=1%S=Z%A=S%F=AR%O=%RD=0%Q=U)
U1(DF=N%T=7B-85%TG=80%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# PC-BSD 1.3 (based on FreeBSD 6)
Fingerprint PC-BSD 1.3
Class PC-BSD | PC-BSD | 1.X | general purpose
CPE cpe:/o:pc-bsd:pc_bsd:1.3 auto
SEQ(SP=FC-10A%GCD=1-6%ISR=107-111%TI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW1NNT11SLL%O2=M5B4NW1NNT11SLL%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11SLL%O5=M5B4NW1NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# PCBSD 9.1
Fingerprint PC-BSD 9.1
Class PC-BSD | PC-BSD | 9.X | general purpose
CPE cpe:/o:pc-bsd:pc_bsd:9.1 auto
SEQ(SP=FA-108%GCD=2|4|6|8|A%ISR=103-10D%TI=I%CI=I%II=I%SS=S%TS=21|22)
OPS(O1=M5B4NW6ST11%O2=M578NW6ST11%O3=M280NW6NNT11%O4=M5B4NW6ST11%O5=M218NW6ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW6SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# "PCMeasure Ethernetbox", appliance for connecting temperature/humidity/... sensors to ethernet.
Fingerprint PCMeasure Ethernetbox environmental monitor
Class PCMeasure | embedded || specialized
SEQ(SP=75-101%GCD=100|200|300|400|500|10000|20000|30000|40000|50000%ISR=10B-115%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M218%O5=M218%O6=M109)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=400%O=M230%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Peplink Balance 380
Fingerprint Peplink Balance 380 router
Class Peplink | embedded || router
CPE cpe:/h:peplink:balance_380 auto
SEQ(SP=101-10B%GCD=1-6%ISR=105-10F%TI=Z%II=I%TS=8)
OPS(O1=M54EST11NW4%O2=M54EST11NW4%O3=M280NNT11NW4%O4=M22CST11NW4%O5=M218ST11NW4%O6=M109ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M54ENNSNW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Pepwave Surf Mini (wireless network extender) Firmware Version: 9.0.44, Hardware Version: 1.5, Model: Surf AP 200 (Router)
Fingerprint Peplink Pepwave Surf AP 200 WAP
Class Peplink | embedded || WAP
CPE cpe:/h:peplink:pepwave_surf_ap_200 auto
SEQ(SP=CE-D8%GCD=1-6%ISR=D9-E3%TI=I%II=RI%SS=O%TS=0)
OPS(O1=M5B4NW0NNT01SNN%O2=M5B4NW0NNT01SNN%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01SNN%O5=M5B4NW0NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3C-46%TG=40%W=8000%O=M5B4NW0SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=A83|2784|32FC|88DD|E893%RIPCK=G%RUCK=A713%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# PerfectOne IP-301 VOIP Phone.
Fingerprint Perfectone IP-301 VoIP phone
Class Perfectone | embedded || VoIP phone
CPE cpe:/h:perfectone:ip-301 auto
SEQ(R=N)
OPS(O1=WANM5B4T10S%O2=M578W0ST10L%O3=T10NNW5NM280%O4=ST10WAL%O5=M218ST10WAL%O6=M109ST10)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=41%TG=40%W=0%O=WANM5B4SNN%CC=N%Q=R)
T1(R=Y%DF=N%T=41%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=N)
U1(DF=N%T=100%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=100%TG=FF%CD=S)

# IOLan DS1 serial io box by perle systems
Fingerprint Perle IOLAN DS1 Ethernet-to-serial bridge
Class Perle | embedded || bridge
SEQ(SP=C5-E1%GCD=1-6%ISR=CF-E1%TI=Z%II=I%TS=9)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Jetstream 8500 Terminal Server
# Perle JETset 3.6.0.G "CONSOLESERVER 9000"
# Specialix JETSTREAM 8500 RS232
Fingerprint Perle JetStream 8500 or CS 9000 remote access server
Class Perle | embedded || remote management
Class Perle | embedded || terminal server
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=800%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=7FC%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# PharLap ETS 13 running LabVIEW Real-Time 8.5
Fingerprint Phar Lap ETS 13
Class Phar Lap | ETS | 13 | specialized
CPE cpe:/o:pharlap:ets:13 auto
SEQ(SP=D7-E1%GCD=1-6%ISR=DB-E5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M200%O5=M218%O6=M109)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=130-13A%TG=FF%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=130-13A%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=130-13A%TG=FF%W=1000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=130-13A%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6D-77%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=82DC%RUD=G)
IE(DFI=N%T=6D-77%TG=80%CD=Z)

# PheeNet 802.11b/g High power access point
Fingerprint PheeNet WAP-854GP WAP
Class PheeNet | embedded || WAP
CPE cpe:/h:pheenet:wap-854gp auto
SEQ(SP=AF-CF%GCD=1-6%ISR=C7-D1%TI=Z%II=I%TS=8)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=35-3F%TG=40%W=16D0%O=M5B4NNSNW7%CC=N%Q=)
T1(R=Y%DF=Y%T=35-3F%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=36-40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# VoIP Phone. Philips DTERM. Vendor of nic is Nitsuko Corporation (00-60-b9).
Fingerprint Philips DTERM VoIP phone
Class Philips | embedded || media device
SEQ(SP=0-4E%GCD=3E8|7D0|BB8|FA0|1388|1E848|3D090|5B8D8|7A120|98968%ISR=9F-A9%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2088%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2238%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=209D%S=O%A=S+%F=AS%O=M109NW0NNSNNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Philips Hue Bridge, FreeRTOS v7.4.2, lwIP v1.4.1
Fingerprint Philips Hue Bridge (lwIP 1.4.1)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP | 1.4.X | general purpose
CPE cpe:/a:lwip_project:lwip:1.4.1 auto
SEQ(SP=5A-72|87-91%GCD=1-6%ISR=94-9E|C6-D0%TI=I%CI=I%II=I|RI%SS=O|S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=860%W2=860%W3=860%W4=860%W5=860%W6=860)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=860%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue Bridge (Wired Ethernet/IP to ZigBee lighting controller) OS: FreeRTOS v6.0.5
Fingerprint Philips Hue Bridge (lwIP stack v1.4.0)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP | 1.4.X | general purpose
CPE cpe:/a:lwip_project:lwip:1.4 auto
SEQ(SP=22-94%GCD=1-6%ISR=72-CA%TI=I|RD%CI=I|RD%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=B68%W2=B68%W3=B68%W4=B68%W5=B68%W6=B68)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=B68%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# FreeRTOS v7.4.2, Philips Hue personal wireless lighting bridge
# Philips Hue bridge
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=5C-88|A5-AF%GCD=1-6%ISR=AC-DD%TI=I%CI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=430%W2=430%W3=430%W4=430%W5=430%W6=430)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=430%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=0-5%GCD=314|628|93C|C50|F64%ISR=62-6C%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=430%W2=430%W3=430%W4=430%W5=430%W6=430)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=430%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=0-5%GCD=AD46|15A8C|207D2|2B518|3625E%ISR=91-9B%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=B68%W2=B68%W3=B68%W4=B68%W5=B68%W6=B68)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=B68%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=B68%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=9D-A7%GCD=1-6%ISR=D1-DB%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=430%W2=430%W3=430%W4=430%W5=430%W6=430)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=430%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Phillips Hue Bridge
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=54-5E%GCD=1-6%ISR=B8-C2%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=430%W2=430%W3=430%W4=430%W5=430%W6=430)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=430%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=430%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue Bridge
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=64-114%GCD=1-6%ISR=9B-A5|BA-E4%TI=I%CI=I%II=I|RI%SS=O|S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=860%W2=860%W3=860%W4=860%W5=860%W6=860)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=860%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Philips Hue Bridge
Fingerprint Philips Hue Bridge (lwIP stack)
Class Philips | embedded || specialized
CPE cpe:/h:philips:hue_bridge
Class lwIP | lwIP || general purpose
CPE cpe:/a:lwip_project:lwip auto
SEQ(SP=79-83%GCD=1-6%ISR=B3-BD%TI=RD%II=RI%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=860%W2=860%W3=860%W4=860%W5=860%W6=860)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=860%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=860%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=50CC%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Philips Hue hub version 01039019.
Fingerprint Philips Hue Bridge 2.0 (Linux)
Class Philips | embedded || specialized
Class Linux | Linux || specialized
CPE cpe:/o:linux:linux_kernel auto
SEQ(SP=FF-109%GCD=1-6%ISR=102-10C%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4NNSNW3%O2=M5B4NNSNW3%O3=M5B4NW3%O4=M5B4NNSNW3%O5=M5B4NNSNW3%O6=M5B4NNS)
WIN(W1=7210%W2=7210%W3=7210%W4=7210%W5=7210%W6=7210)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=7210%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Phoenix Contact PLC (industrial controller): model ILC 171 ETH 2TX
Fingerprint Phoenix Contact ILC 171 ETH 2TX PLC
Class Phoenix Contact | embedded || specialized
CPE cpe:/h:phoenix_contact:ilc_171_eth_2tx
SEQ(SP=86-90%GCD=1-6%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B0%O2=M578%O3=M280%O4=M5B0%O5=M218%O6=M109)
WIN(W1=2DA0%W2=2DA0%W3=2DA0%W4=2DA0%W5=2DA0%W6=2DA0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2DA0%O=M5B0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2DA0%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Pingtel xpressa VoIP phone
Fingerprint Pingtel Xpressa VoIP phone
Class Pingtel | embedded || VoIP phone
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B0NW0%O2=M5B0NW0%O3=M5B0NW0%O4=M5B0NW0%O5=M5B0NW0%O6=M5B0)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B0NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Pioneer Kuro KRP-500M
Fingerprint Pioneer Kuro KRP-500M monitor
Class Pioneer | embedded || media device
SEQ(SP=0-6C%GCD=1-6|1FD03|3FA06|5F709|7F40C|9F10F%ISR=9C-A6%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M400%O2=M400%O3=M280%O4=M400%O5=M218%O6=M109)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=400%O=M400%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=3FB%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=2B-35%TG=40%CD=S)

# Pioneer PRO-141 Signature Series Plasma HD Monitor
Fingerprint Pioneer PRO-141 TV
Class Pioneer | embedded || media device
SEQ(SP=8D-97%GCD=1-6%ISR=CA-D4%TI=I|RD%CI=I%II=RI%TS=U)
OPS(O1=M400%O2=M400%O3=M280%O4=M400%O5=M218%O6=M109)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=N)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=O|A+%A=O|S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A|O%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A|O%A=O|S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A|O%A=O|S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=0|2E24|9729|C465|D998%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=21-3E%TG=40%CD=S)

# Pioneer SC-27 Audio/Video Receiver
Fingerprint Pioneer SC-27 audio/video receiver
Class Pioneer | embedded || media device
SEQ(SP=B-15%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=96-A0%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=N)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Pioneer VSX-31 A/V Receiver
Fingerprint Pioneer VSX-31 video receiver
Class Pioneer | embedded || media device
CPE cpe:/h:pioneer:vsx-31
SEQ(SP=F-19%GCD=10000|20000|30000|40000|50000%ISR=C6-D0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M5B4%O4=M5B4%O5=M218%O6=M109)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=8000%O=M5B4%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=O%A=S+%F=AS%O=M5B4%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Pirelli DP10 GSM/VOIP Phone
Fingerprint Pirelli DP-10 VoIP phone
Class Pirelli | embedded || VoIP phone
CPE cpe:/h:pirelli:dp-10 auto
SEQ(SP=E8-10A%GCD=1-6%ISR=106-110%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=7F%TG=80%W=3E80%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7F%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7F%TG=80%W=3E80%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7F%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7F%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7F%TG=80%CD=S)

# Pirelli PRG AV4202N(2) with Software-Version E_3.0.11 it runs with OpenRG
Fingerprint Pirelli AV4202N wireless ADSL modem
Class Pirelli | embedded || WAP
CPE cpe:/h:pirelli:av4202n auto
SEQ(SP=C7-D1%GCD=1-6%ISR=C7-D2%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4NNSNW1%O2=M5B4NNSNW1%O3=M5B4NW1%O4=M5B4NNSNW1%O5=M5B4NNSNW1%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4NNSNW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Pirelli Broadband Solutions:  pirelli modem adsl+wi-fi+voip, DRG A226M
Fingerprint Pirelli DRG A226M wireless ADSL modem
Class Pirelli | embedded || WAP
CPE cpe:/h:pirelli:drg_a226m auto
SEQ(SP=C0-CA%GCD=1-6%ISR=C0-CA%TI=Z%II=I%TS=8)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=19-23%TG=20%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=19-23%TG=20%W=16A0%S=O%A=O|S+%F=A|AS%O=NNT11|M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Pirelli PRGAV4202N Firmware 4.8.3.DWVV_TAU_5.2.3
Fingerprint Pirelli PRG AV4202N WAP
Class Pirelli | embedded || WAP
CPE cpe:/h:pirelli:prg_av4202n
SEQ(SP=C3-CD%GCD=1-6%ISR=CB-D5%TI=Z%CI=Z%II=I%TS=8)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW1%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=7D3F%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Planet VoIP adapter, ATA-150S
Fingerprint Planet ATA-150S VoIP adapter
Class Planet | embedded || VoIP adapter
CPE cpe:/h:planet:ata-150s auto
SEQ(SP=BE-C8%GCD=1-6%ISR=BF-C9%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M55CST11NW0%O2=M55CST11NW0%O3=M55CNNT11NW0%O4=M55CST11NW0%O5=M55CST11NW0%O6=M55CST11)
WIN(W1=1540%W2=1540%W3=1540%W4=1540%W5=1540%W6=1540)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1570%O=M55CNNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1540%S=O%A=S+%F=AS%O=M55CST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Planet VIP-550PT VoIP Phone
Fingerprint Planet VIP-550PT VoIP phone
Class Planet | embedded || VoIP phone
CPE cpe:/h:planet:vip-550pt auto
SEQ(SP=96-A0%GCD=1-6%ISR=9C-A6%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=8B-95%TG=FF%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=8B-95%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=8B-95%TG=FF%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=8B-95%TG=FF%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=8B-95%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=8B-95%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=8B-95%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=8B-95%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=8B-95%TG=FF%CD=S)

# Planet WAP-1950, Firmware Version: 2.9.4, Hardware Version: 3.1
Fingerprint Planet WAP-1950 WAP
Class Planet | embedded || WAP
CPE cpe:/h:planet:wap-1950 auto
SEQ(SP=0-19%GCD=A|14|1E|28|32|6E|DC|14A|1B8|226%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=N)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Planet WAP 4000v2 soft ver. 2.05
Fingerprint Planet WAP-4000 v2 WAP
Class Planet | embedded || WAP
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=7F%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7F%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7F%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7F%TG=80%CD=S)

# Planet VoIP Phone Model VIP-154T, OS: MicroC/OS-II, uC/OS-II
Fingerprint Planet VIP-154T VoIP phone (MicroC/OS-II)
Class Planet | MicroC/OS-II || VoIP phone
CPE cpe:/o:planet:microc_os_ii auto
SEQ(SP=0-21%GCD=FA|1F4|2EE|3E8|4E2%ISR=8A-94%TI=I%II=RI%SS=O%TS=U)
OPS(O1=WANM5B4T10S%O2=M578W0ST10L%O3=T10NNW5NM280%O4=ST10WAL%O5=M218ST10WAL%O6=M109ST10)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=WANM5B4SNN%CC=N%Q=R)
T1(R=Y%DF=N%T=3B-45%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IP 601
# IP 301
Fingerprint Polycom SoundPoint 301 or 601 IP phone
Class Polycom | embedded || VoIP phone
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=1042%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom SoundPoint 320 (firmware 2.1.1.0037)
# Polycom SoundPoint IP 430, SIP stack version 2.1.0.2708
# Polycom SoundPoint IP 330/320.
# Polycom SoundPoint 550 IP phone
# Polycom IP650
Fingerprint Polycom SoundPoint 320, 330, 430, 550, or 650 IP phone
Class Polycom | embedded || VoIP phone
SEQ(SP=96-A0%GCD=1-6%ISR=9B-A5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I|Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom SoundPoint IP 601 Assembly: 2345-11605-001 Rev:A BootBlock: 2.6.0 (11605_001) Bootrom: 3.1.2.0011 06-Oct-05 14:29 ( Sip Version 1.6.4.0064 Poly DSP Orion Mem2 FS1 Version 1.3.3.0010 )
# Polycom version 2.12.0078
# SoundPoint IP 500
Fingerprint Polycom SoundPoint 500 or 601 IP phone
Class Polycom | embedded || VoIP phone
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom Soundpoint 501
Fingerprint Polycom SoundPoint 501 IP phone
Class Polycom | embedded || VoIP phone
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SoundPoint IP 501
Fingerprint Polycom SoundPoint 501 IP phone
Class Polycom | embedded || VoIP phone
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M564%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom IP-301  Firmware Version:          Mon Jul 9 10:11:39 2007
Fingerprint Polycom SoundPoint IP 301 VoIP phone
Class Polycom | embedded || VoIP phone
CPE cpe:/h:polycom:soundpoint_ip_301 auto
SEQ(SP=0-5%GCD=3E8|7D0|BB8|FA0|1388%ISR=8A-94%TI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4|WANM5B4T10S%O2=M578|M578W0ST10L%O3=M280|T10NNW5NM280%O4=M5B4|ST10WAL%O5=M218ST10WAL%O6=M109ST10)
WIN(W1=0|3180%W2=0|3180%W3=0|3180%W4=0|3180%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=WANM5B4SNN%CC=N%Q=R)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# PolyCom IP-301 VoIP Desktop Phone, I believe the polycom phones run embedded VxWorks OS.
Fingerprint Polycom SoundPoint IP 301 VoIP phone
Class Polycom | embedded || VoIP phone
CPE cpe:/h:polycom:soundpoint_ip_301 auto
SEQ(SP=97-A1%GCD=1-6%ISR=9C-A6%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom SoundPoint IP 331 VoIP phone
Fingerprint Polycom SoundPoint IP 331 VoIP phone
Class Polycom | embedded || VoIP phone
CPE cpe:/h:polycom:soundpoint_ip_331 auto
SEQ(SP=7F-D3%GCD=1-6%ISR=9B-D1%TI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(R=N)

# Polycom IP 430 SIP VoIP Phone
Fingerprint Polycom SoundPoint IP 430 VoIP phone
Class Polycom | embedded || VoIP phone
CPE cpe:/h:polycom:soundpoint_ip_430 auto
SEQ(SP=95-9F%GCD=1-6%ISR=9B-A5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Polycom MGC Video Bridge (MCU) running software version 6.03
Fingerprint Polycom MGC videoconferencing system
Class Polycom | embedded || webcam
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Polycom RMX2000
Fingerprint Polycom RMX 2000 videoconferencing system
Class Polycom | embedded || webcam
SEQ(SP=CB-D5%GCD=1-6%ISR=CA-D4%TI=I%CI=Z%II=I%SS=S%TS=A)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Polycom ViewStation 4000 PRI T1 MP Release 6.0.5 FX
Fingerprint Polycom ViewStation 4000 video conferencing system
Class Polycom | embedded || webcam
CPE cpe:/h:polycom:viewstation_4000 auto
SEQ(SP=0-16%GCD=0|6257C2|C4AF84|1270746|1895F08|1EBB6CA%ISR=0-C2%TI=I%CI=I%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=5B40%W2=5B40%W3=5B40%W4=5B40%W5=5B40%W6=5B40)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=0|5B40%O=|M218%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=0|9CD7%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=Z)

# Polycom ViewStation DCP, Release 7.5.2 - 24 Dec 2003
Fingerprint Polycom ViewStation DCP 7.5.2 video conferencing system
Class Polycom | embedded || webcam
SEQ(SP=0-5%GCD=0%ISR=0-5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=5B40%W2=5B40%W3=5B40%W4=5B40%W5=5B40%W6=5B40)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=EB93%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=Z)

# Polycom ViewStation 4000 PRI T1 MP, Release 6.0.5 FX - 08 Jun 2005
# Polycom ViewStation FX4 / Software Release 6.0.5 FX - 08 Jun 2005 / Boot Software BootUI Version 19.2 FX
# Polycom Viewstation FX Model: PN4-14xx
Fingerprint Polycom ViewStation video conferencing system
Class Polycom | embedded || webcam
SEQ(SP=0-18%GCD=1-6|>1000000%ISR=0-151%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B40%W2=5B40%W3=5B40%W4=5B40%W5=5B40%W6=5B40)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=Z)

# Polycom VS4000 Video conference codec.
Fingerprint Polycom VS4000 video conferencing system
Class Polycom | embedded || webcam
CPE cpe:/h:polycom:vs4000 auto
SEQ(SP=C-16%GCD=284D455|509A8AA|78E7CFF|A135154|C9825A9%ISR=CE-D8%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M5B4%O2=|M5B4%O3=|M5B4%O4=|M5B4%O5=|M5B4%O6=|M5B4)
WIN(W1=0|5B40%W2=0|5B40%W3=0|5B40%W4=0|5B40%W5=0|5B40%W6=0|5B40)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=0|5B40%O=|M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%S=O%A=O|S+%F=A|AS%O=|M5B4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=3353%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=Z)

# Polycom VSFX4, Release 6.0.5 FX - 08 Jun 2005
Fingerprint Polycom VSFX4 video conferencing system
Class Polycom | embedded || webcam
CPE cpe:/h:polycom:vsfx4 auto
SEQ(SP=0-16%GCD=8497DA1|1092FB42|18DC78E3|2125F684|296F7425%ISR=0-E5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=5B40%W2=5B40%W3=5B40%W4=5B40%W5=5B40%W6=5B40)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=5B40%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=1D17|2520|29F6|E028%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=Z)

# Polycom Video Conferencing Device VSX 7000a, Release 8.5.3.2 - 17Apr2007 15:09
Fingerprint Polycom VSX 7000a video conferencing system
Class Polycom | embedded || webcam
CPE cpe:/h:polycom:vsx_7000a auto
SEQ(SP=3-7F%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=96-E6%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5A2%O2=M578%O3=M280%O4=M5A2%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=7F%TG=80%W=2000%O=M5A2%CC=N%Q=)
T1(R=Y%DF=N%T=7F%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7F%TG=80%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=7F%TG=80%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7F%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7F%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7F%TG=80%CD=S)

# Polycom VSX 7000e Video Conference
# Polycom VSX 8000 Video Conference
Fingerprint Polycom VSX 7000e/8000 video conferencing system
Class Polycom | embedded || webcam
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5A2%O2=M578%O3=M280%O4=M5A2%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=2000%O=M5A2%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Polycom VSX 8000 embedded OS.
Fingerprint Polycom VSX 8000 video conferencing system
Class Polycom | embedded || webcam
CPE cpe:/h:polycom:vsx_8000 auto
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%II=I%TS=U)
OPS(O1=M5A2%O2=M578%O3=M280%O4=M5A2%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=2000%O=M5A2%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Polycom MGC-25. "pSOSystem FTP server (NTL386/1.0.4) ready."
Fingerprint Polycom MGC-25 videoconferencing system (pSOS 1.0.4)
Class Polycom | pSOS | 1.X | webcam
CPE cpe:/o:polycom:psos:1.0.4 auto
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Portech GSM VoIP GSM:900/1800MHz v6.0 gateway
Fingerprint PORTech GSM VoIP adapter
Class PORTech | embedded || VoIP adapter
SEQ(SP=0-16%GCD=FA|1F4|2EE|3E8|4E2|61A8|C350|124F8|186A0|1E848%ISR=8A-94%TI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=3180%W2=3180%W3=3180%W4=3180%W5=3180%W6=3180)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3180%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3180%S=O%A=O|S+%F=APS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# VoIP GSM Gateway model: MV-370
Fingerprint PORTech MV-370 GSM VoIP adapter
Class PORTech | embedded || VoIP adapter
SEQ(SP=A-14%GCD=FA|1F4|2EE|3E8|4E2%ISR=8A-94%TI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4|WANM5B4T10S%O2=M578|M578W0ST10L%O3=M280|T10NNW5NM280%O4=M5B4|ST10WAL%O5=M218|M218ST10WAL%O6=M109ST10)
WIN(W1=3180%W2=3180%W3=3180%W4=3180%W5=3180%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=WANM5B4SNN%CC=N%Q=R)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# MQX realtime OS with RTCS TCP/IP stack from  Precise Software Technologies Inc.
Fingerprint MQX RTOS
Class Precise Software Technologies | MQX || specialized
CPE cpe:/o:precisesoftwaretechnologies:mqx auto
SEQ(SP=100-10A%GCD=1-6%ISR=104-10E%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=200%W2=200%W3=200%W4=200%W5=200%W6=200)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=200%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Printmax T5304r Printer using Ethernet Firmware 1.4.3.3
Fingerprint Printronix T5304 label printer
Class Printronix | embedded || printer
SEQ(SP=D-1B%GCD=1-6%ISR=30-3A%TI=I%CI=I%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M1AE%O5=M218%O6=M109)
WIN(W1=35C%W2=35C%W3=35C%W4=35C%W5=35C%W6=35C)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=35C%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=1B-25%TG=20%W=35C%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(R=N)

# Priva building management system w/ HX08 IP module (www.priva.nl)
Fingerprint Priva building management system
Class Priva | embedded || specialized
SEQ(SP=C9-D3%GCD=1-6%ISR=D5-DF%TI=I%II=I%SS=S%TS=U)
OPS(O1=M54C|M5B4%O2=M54C|M578%O3=M280%O4=M200|M54C%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M54C|M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Proxim Tsunami MP11a BSU (802.11a).
Fingerprint Proxim Tsunami MP.11a WAP
Class Proxim | embedded || WAP
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B8NW0NNT11%O2=M5B8NW0NNT11%O3=M5B8NW0NNT11%O4=M5B8NW0NNT11%O5=M5B8NW0NNT11%O6=M5B8NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B8NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# user mode network gateway in QEMU 0.12.3, built from MacPorts 1.8.2 on Mac OS X 10.6.2. (qemu -net nic -net user)
Fingerprint QEMU user mode network gateway
Class QEMU | QEMU || general purpose
CPE cpe:/a:qemu:qemu
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%CI=I|RD%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

Fingerprint QEMU user mode network gateway
Class QEMU | QEMU || general purpose
CPE cpe:/a:qemu:qemu
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=RD%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3C-46%TG=40%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FB-105%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FB-105%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=2F-39%TG=40%CD=S)

# Linux 2.6.32-5-orion5x #1 Sun May 6 21:27:49 UTC 2012 armv5tel GNU/Linux / Debian GNU/Linux 6.0.5 (squeeze) QNAP TS-109
Fingerprint QNAP TS-109 NAS device (Linux 2.6.32)
Class QNAP | embedded || storage-misc
CPE cpe:/h:qnap:ts-109 auto
Class Linux | Linux | 2.6.X | storage-misc
CPE cpe:/o:linux:linux_kernel:2.6.32 auto
SEQ(SP=104-10E%GCD=1-6%ISR=104-10E%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5ACST11NW4%O2=M5ACST11NW4%O3=M5ACNNT11NW4%O4=M5ACST11NW4%O5=M5ACST11NW4%O6=M5ACST11)
WIN(W1=1680%W2=1680%W3=1680%W4=1680%W5=1680%W6=1680)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16B0%O=M5ACNNSNW4%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1680%S=O%A=S+%F=AS%O=M5ACST11NW4%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Linux QNAP 2.6.12.6-arm1 #2 Sun Sep 18 02:09:29 CST 2011 armv5tejl unknown
Fingerprint QNAP TS-209 NAS device (Linux 2.6.12)
Class QNAP | embedded || storage-misc
CPE cpe:/h:qnap:ts-209 auto
Class QNAP | QTS | 4.X | storage-misc
CPE cpe:/o:qnap:qts:4 auto
Class Linux | Linux | 2.6.X | storage-misc
CPE cpe:/o:linux:linux_kernel:2.6.12 auto
SEQ(SP=BA-C4%GCD=1-6%ISR=C0-CA%TI=Z%II=I%TS=7)
OPS(O1=M2304ST11NW2%O2=M2304ST11NW2%O3=M2304NNT11NW2%O4=M2304ST11NW2%O5=M2304ST11NW2%O6=M2304ST11)
WIN(W1=45F0%W2=45F0%W3=45F0%W4=45F0%W5=45F0%W6=45F0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4608%O=M2304NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=45F0%S=O%A=S+%F=AS%O=M2304ST11NW2%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# QNAP TS-859 running QTS 4.0.3
# QNAP TS-439 running QTS 4.0.7, TS-439 is an oldish NAS appliance.
# QTS 4.2.0
Fingerprint QNAP QTS 4.0 - 4.2
Class QNAP | QTS | 4.X | storage-misc
CPE cpe:/o:qnap:qts:4 auto
SEQ(SP=ED-109%GCD=1-6%ISR=FD-110%TI=Z%CI=Z%II=I%TS=A|B)
OPS(O1=MFC2ST11NW7%O2=MFC2ST11NW7%O3=MFC2NNT11NW7%O4=MFC2ST11NW7%O5=MFC2ST11NW7%O6=MFC2ST11)
WIN(W1=2F22%W2=2F22%W3=2F22%W4=2F22%W5=2F22%W6=2F22)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2F46%O=MFC2NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# QNAP TS-209 Pro running Linux 2.6.12.6-arm1
# Linux NAS 2.6.12.6-arm1 #6 Wed Jul 8 15:11:08 CST 2009 armv5tejl GNU/Linux
Fingerprint QNAP QTS NAS device (Linux 2.6.12)
Class QNAP | QTS || storage-misc
CPE cpe:/o:qnap:qts auto
Class Linux | Linux | 2.6.X | storage-misc
CPE cpe:/o:linux:linux_kernel:2.6.12 auto
SEQ(SP=C1-CF%GCD=1-6%ISR=B8-D6%TI=Z%CI=I%II=I%TS=7)
OPS(O1=M2304ST11NW2%O2=M2304ST11NW2%O3=M2304NNT11NW2%O4=M2304ST11NW2%O5=M2304ST11NW2%O6=M2304ST11)
WIN(W1=45F0%W2=45F0%W3=45F0%W4=45F0%W5=45F0%W6=45F0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4608%O=M2304NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=45F0%S=O%A=S+%F=AS%O=M2304ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# QNX 4.X
# QNX 1 425 PCI 32
Fingerprint QNX RTOS 4.25
Class QNX | RTOS | 4.X | specialized
CPE cpe:/o:qnx:rtos:4.25 auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9B-A7%TI=I%CI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1C84%W2=1B58%W3=1E00%W4=2000%W5=1F68%W6=1F0E)
ECN(R=Y%DF=N%T=37-41%TG=40%W=1C84%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=1F0E%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Real Time OS QNX 4.25
Fingerprint QNX RTOS 4.25
Class QNX | RTOS | 4.X | specialized
CPE cpe:/o:qnx:rtos:4.25 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=1F0E)
ECN(R=Y%DF=N%T=37-41%TG=40%W=2000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=1F0E%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=F9-103%TG=FF%CD=S)

# QNX 6.2, Hardware platform is JACE6
Fingerprint QNX RTOS 6.2
Class QNX | RTOS | 6.X | general purpose
CPE cpe:/o:qnx:rtos:6.2 auto
SEQ(SP=C4-DE%GCD=1-6%ISR=D7-E1%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# QNX 6.2.1 x86pc x86 on AMD K6/III 400 MHz
Fingerprint QNX RTOS 6.2.1
Class QNX | RTOS | 6.X | general purpose
CPE cpe:/o:qnx:rtos:6.2.1 auto
SEQ(SP=C7-D7%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# QNX 6.3 with ftp and telnet enabled (VMWare)
Fingerprint QNX RTOS 6.3
Class QNX | RTOS | 6.X | general purpose
CPE cpe:/o:qnx:rtos:6.3 auto
SEQ(SP=C7-DB%GCD=1-6%ISR=D5-DF%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# QNX localhost 7.0.0 2017/02/14-16:01:20EST x86_PC x86_64
Fingerprint QNX RTOS 7.0.0
Class QNX | RTOS | 7.X | specialized
CPE cpe:/o:qnx:rtos:7.0.0 auto
SEQ(SP=CD-D7%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW3NNT11SNN%O2=M5B4NW3NNT11SNN%O3=M5B4NW3NNT11%O4=M5B4NW3NNT11SNN%O5=M5B4NW3NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW3SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=O%A=S+%F=AS%O=M5B4NW3NNT11SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Tridium Niagara HVAC controller running QNX
Fingerprint QNX RTOS
Class QNX | RTOS || general purpose
CPE cpe:/o:qnx:rtos auto
SEQ(SP=CA-D4%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M5ACNW0NNT01%O2=M5ACNW0NNT01%O3=M5ACNW0NNT01%O4=M5ACNW0NNT01%O5=M5ACNW0NNT01%O6=M5ACNNT01)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3D-47%TG=40%W=4000%O=M5ACNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3D-47%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3D-47%TG=40%W=4000%S=O%A=S+%F=AS%O=M5ACNW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3D-47%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3D-47%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FC-106%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FC-106%TG=FF%CD=S)

# QTECH QSW-2900-24T V100R001B01D003SP4
Fingerprint QTech QSW-2900 switch
Class QTech | embedded || switch
CPE cpe:/h:qtech:qsw-2900 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Qualisys Oqus 300 cameras, which are part of a motion capture system [Looks like ELK-M1EXP --Ed.]
Fingerprint Qualisys Oqus 300 camera
Class Qualisys | embedded || webcam
CPE cpe:/h:qualisys:oqus_300
SEQ(SP=C5-CF%GCD=1-6%ISR=D6-E0%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=6A-74%TG=80%W=4000%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=6A-74%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6A-74%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=7EA2%RUD=G)
IE(DFI=N%T=6A-74%TG=80%CD=Z)

# Guardian OS running on a Quantum Snap Server 2200 (now owned by Adaptec)
# SnapAppliance SnapServer 4100
Fingerprint Quantum Snap Server 2200 or 4100 NAS device
Class Quantum | embedded || storage-misc
SEQ(SP=0-5%GCD=12C00|25800|38400|4B000|5DC00%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2238%W2=2238%W3=2238%W4=2238%W5=2238%W6=2238)
ECN(R=Y%DF=N%T=1E%TG=20%W=2238%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=1E%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=1E%TG=20%W=2238%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=1E%TG=20%W=2238%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1E%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1E%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1E%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Quantum Autoloader 3, identifies as V43.0 (002B.0h) (Changer part), 1923 (drive part)
Fingerprint Quantum SuperLoader 3 tape autoloader
Class Quantum | embedded || storage-misc
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=58F2|98E5|9D75|BF9B|C0D2%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Quantum SuperLoader 3
Fingerprint Quantum SuperLoader 3 tape autoloader
Class Quantum | embedded || storage-misc
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=200%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# desqview/x version 2.10, originally Quarterdeck they were bought out by symantec years ago
Fingerprint Quarterdeck DESQview/X 2.10
Class Quarterdeck | DESQview/X | 2.X | general purpose
CPE cpe:/o:quarterdeck:desqview_x:2.10 auto
SEQ(SP=0-16%GCD=10001|20002|30003|40004|50005|EFFFF|1DFFFE|2CFFFD|3BFFFC|4AFFFB%ISR=0-AC%TI=I%II=I%SS=S%TS=U)
OPS(O1=M240%O2=M578%O3=M240%O4=M240%O5=M218%O6=M109)
WIN(W1=480%W2=AF0%W3=480%W4=480%W5=430%W6=212)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=480%O=M240%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=O%F=AS%O=M240%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Zworld Rabbit microprocessor running a program written in Dynamic C v8.
Fingerprint Rabbit microcontroller
Class Rabbit | embedded || specialized
SEQ(SP=63-83%GCD=10000|20000|30000|40000|50000%ISR=10B-115%TI=I%II=I%SS=S%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M218%O5=M218%O6=M109)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M230%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# RAD (www.rad.com) equipment - a RAD ACE 3200
Fingerprint RAD ACE-3200 telephony switch
Class RAD Data Communications | embedded || switch
SEQ(SP=92-A0%GCD=1-6%ISR=9B-A5%TI=I%TS=1)
OPS(O1=M606NW0NNT11%O2=M606NW0NNT11%O3=M606NW0NNT11%O4=M606NW0NNT11%O5=M606NW0NNT11%O6=M606NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M606NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M606NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(R=N)

# AS2 - aplication switch 2 LinkProof Application Switch - with SynApps, DoS Shield v4.35.07
Fingerprint Radware LinkProof load balancer
Class Radware | APsolute OS | 10.X | load balancer
CPE cpe:/o:radware:apsolute_os:10 auto
SEQ(SP=E9-109%GCD=1-6%ISR=EF-10D%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Radware OnDemand Switch 2 XL APSolute OS Operating System Version: 10.31-08.06:2.06.10
Fingerprint Radware OnDemand Switch 2 XL (APsolute OS 10.31)
Class Radware | APsolute OS | 10.X | load balancer
CPE cpe:/o:radware:apsolute_os:10.31 auto
SEQ(SP=FD-107%GCD=2|4|6|8|A%ISR=106-110%TI=I%II=I%SS=S%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M564%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Raritan PDU.  Model number Model: PX (DPXR20-20L)
Fingerprint Raritan Dominion PX DPXR20-20L power control unit
Class Raritan | embedded || power-device
SEQ(SP=C3-CD%GCD=1-6%ISR=CC-D6%TI=Z%CI=I%II=I%TS=7)
OPS(O1=M558ST11NW1%O2=M558ST11NW1%O3=M558NNT11NW1%O4=M558ST11NW1%O5=M558ST11NW1%O6=M558ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=16D0%O=M558NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3A-44%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3A-44%TG=40%CD=S)

# Raritan Dominion KX II KVM
Fingerprint Raritan Dominion KX II KVM
Class Raritan | embedded || remote management
SEQ(SP=C8-D2%GCD=1-6%ISR=CB-D5%TI=Z%CI=Z%II=I%TS=8)
OPS(O1=M56AST11NW2%O2=M56AST11NW2%O3=M56ANNT11NW2%O4=M56AST11NW2%O5=M56AST11NW2%O6=M56AST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M56ANNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Raritan Dominion KX-II KVM switch, which runs linux: RFC1213-MIB::sysObjectID.0 = OID: NET-SNMP-TC::linux
Fingerprint Raritan Dominion KX II KVM switch
Class Raritan | embedded || remote management
CPE cpe:/h:raritan:dominion_kx-ii auto
SEQ(SP=C4-CE%GCD=1-6%ISR=CA-D4%TI=Z%TS=A)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3D-47%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3D-47%TG=40%W=0%S=A|O%A=O|S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Dominion SX32 [128Mb] Firmware Version : 3.1.6.5.1 Kernel Version : 2.4.12 PMON Version: 2.0.1 RSC Version: 3.0.0.5.19
# Ricoh Aficio IS200e
Fingerprint Raritan Dominion SX32 KVM switch or Ricoh Aficio IS200e scanner
Class Raritan | embedded || remote management
CPE cpe:/h:raritan:dominion_sx32
Class Ricoh | embedded || media device
CPE cpe:/h:ricoh:is200e
SEQ(SP=BE-C8%GCD=1-6%ISR=C5-CF%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11%O2=M5B4ST11%O3=M5B4NNT11%O4=M5B4ST11%O5=M5B4ST11%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNS%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11%RD=0)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# RCA Comcast DCM425C cable modem, firmware ST52.03.00
Fingerprint RCA DCM425C cable modem
Class RCA | embedded || broadband router
CPE cpe:/h:rca:dcm425c auto
SEQ(SP=F4-FE%GCD=1-6%ISR=F4-102%TI=I%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=41%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=41%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# ReactOS 0.3.7 with some default services started (shipped with ReactOS)
Fingerprint ReactOS 0.3.7
Class ReactOS | ReactOS | 0.3.X | general purpose
CPE cpe:/o:reactos:reactos:0.3.7 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(R=N)

# Red-M Communications Red-Alert PRO bluetooth/wifi activity detector
# MULTIBAND PROBE - Red-Alert PRO v4.1.20/2.6.5; http://www.red-m.com
# Linksys WET54G Version 3 Firmware version 2.07
Fingerprint Linksys WET54G wireless bridge or Red-M Communications Red-Alert PRO wireless activity detector
Class Red-M | embedded || firewall
Class Linksys | embedded || bridge
CPE cpe:/h:linksys:wet54g auto
SEQ(SP=91-9B%GCD=1-6%ISR=98-A2%TI=RD%II=RI%TS=1)
OPS(O1=M5A8NW0NNT11%O2=M5A8NW0NNT11%O3=M5A8NW0NNT11%O4=M5A8NW0NNT11%O5=M5A8NW0NNT11%O6=M5A8NNT11)
WIN(W1=43E0%W2=4110|467C|4BE8|5154|56C0%W3=423C|44B0|4998|50F4|55DC%W4=43E0%W5=4180|4598|49B0|4FD4|55F8%W6=403D|4431|4A1F|500D|54FE)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=403D|4431|4A1F|500D|54FE%S=O%A=O|S+%F=AS%O=M5A8NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=3401%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Redback Networks SmartEdge OS Version SEOS-11.1.2.9-Release
Fingerprint Ericsson SmartEdge router (SmartEdge OS 11.1)
Class Redback | SmartEdge OS | 11.X | router
CPE cpe:/o:redback:smartedge_os:11.1 auto
SEQ(SP=CD-D9%GCD=1-6%ISR=D8-E2%TI=I%II=RI%SS=O|S%TS=1)
OPS(O1=M578NW0NNT11%O2=M578NW0NNT11%O3=M578NW0NNT11%O4=M578NW0NNT11%O5=M578NW0NNT11%O6=M578NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M578NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Redback Networks router running SmartEdge OS Version SEOS-5.0.3.2-Release
# RedBack SmartEdge 100 SmartEdge OS 5.0.3.2
Fingerprint Redback Networks SmartEdge router (SmartEdge OS 5.0)
Class Redback | SmartEdge OS | 5.X | broadband router
CPE cpe:/o:redback:smartedge_os:5.0 auto
SEQ(SP=CD-DB%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M578NW0NNT11%O2=M578NW0NNT11%O3=M578NW0NNT11%O4=M578NW0NNT11%O5=M578NW0NNT11%O6=M578NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M578NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# redback SE600
Fingerprint Redback Networks SmartEdge 600 router (SmartEdge OS)
Class Redback | SmartEdge OS || broadband router
CPE cpe:/o:redback:smartedge_os auto
SEQ(SP=CD-D7%GCD=1-6%ISR=D8-E2%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M578NW0NNT01SNN%O2=M578NW0NNT01SNN%O3=M578NW0NNT01%O4=M578NW0NNT01SNN%O5=M578NW0NNT01SNN%O6=M578NNT01SNN)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=8000%O=M578NW0SNN%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# http://www.reliablecontrols.com/products/controllers/MPWC/feature.html
Fingerprint Reliable Controls MAC ProWebCom building control server
Class Reliable Controls | embedded || specialized
SEQ(SP=F9-103%GCD=1-6%ISR=104-10E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=2238%W2=2238%W3=2238%W4=2238%W5=2238%W6=2238)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2238%O=M5AC%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Revo Blik WiFi, a device using a Frontier Silicon Venice6 module using the Chorus2 DSP/processor.
# Revo Blik wi-fi
Fingerprint Revo Blik Wi-Fi Internet radio
Class Revo | embedded || media device
CPE cpe:/h:revo:blik_wi-fi
SEQ(SP=0-41%GCD=1-6|399-39F%ISR=64-9F%TI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0-FFFF%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=24-3D%TG=40%CD=S)

# RFCode RFID Reader
Fingerprint RF Code RFID reader
Class RF Code | embedded || specialized
SEQ(SP=A3-B1%GCD=1-6%ISR=AD-B7%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=200%W2=200%W3=200%W4=200%W5=200%W6=200)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=200%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=200%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# RF-Space SDR-IP firmware v1.05
Fingerprint RF-Space SDR-IP software radio or WIZnet W5200 TCP/IP Ethernet chip
Class RF-Space | embedded || specialized
Class WIZnet | embedded || specialized
CPE cpe:/h:wiznet:w5200
SEQ(R=N)
OPS(O1=|M5B4%O2=|M578)
WIN(W1=0|1FFE%W2=0|1FFE%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0%CC=N)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=A|O%A=O|S+%F=AR|AS%RD=0)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S+%F=AR%RD=0)
U1(DF=Y%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# RGB spectrum MediaWall 1500 video processor
Fingerprint RGB Spectrum MediaWall 1500 video processor
Class RGB Spectrum | embedded || media device
SEQ(SP=C5-CF%GCD=1-6%ISR=CA-D4%TI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Ricoh Aficio 1022
Fingerprint Ricoh Aficio 1022 copier
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_1022 auto
SEQ(SP=9C-A6%GCD=1-6%ISR=A7-B1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Ricoh Aficio 2035e  System: 2.40 NIB: 4.12 Printer
# RICOH Aficio 1060 - version 3.53.3, network control service version 3.74
Fingerprint Ricoh Aficio 1060 or 2035e printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_2035e auto
CPE cpe:/h:ricoh:aficio_1060 auto
SEQ(SP=93-AF%GCD=1-6%ISR=A7-B2%TI=I%II=I%SS=S%TS=1|2)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Aficio Ricoh AP400N Network Printer
# RICOH Aficio 1224C  2.07.2, Firmware Version: 3.74
Fingerprint Ricoh Aficio 1224C or AP400N printer
Class Ricoh | embedded || printer
SEQ(SP=98-B8%GCD=1-6%ISR=A7-B5%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# RICOH Aficio 3245C Copier, Printer, Scanner, Fax (MFP)
# RICOH Aficio 3045 - Copier, Printer, Scanner, Fax (MFP)
# Savin 8025e
Fingerprint Ricoh Aficio 3045/3245C or Savin 8025e printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_3045
CPE cpe:/h:ricoh:aficio_3245c
Class Savin | embedded || printer
CPE cpe:/h:savin:8025e auto
SEQ(SP=C2-DD%GCD=1-6%ISR=D7-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Ricoh Aficio BP20N
Fingerprint Ricoh Aficio BP20N printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_bp20n auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# RICOH Aficio MP C2550
Fingerprint Ricoh Aficio MP C2550 printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_mp_c2550 auto
SEQ(SP=C7-D9%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT01%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Ricoh Aficio MP C4501
Fingerprint Ricoh Aficio MP C4501 printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_mp_c4501
SEQ(CI=I%II=I)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3A-44%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3A-44%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# RICOH Aficio MP C6000 (printer, multifunction)
# Ricoh GX 3050N printer
Fingerprint Ricoh Aficio MP C6000 or GX3050N printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_mp_c6000
CPE cpe:/h:ricoh:aficio_mp_gx3050n
SEQ(SP=BA-DE%GCD=1-6%ISR=D9-E3%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# RICOH Aficio SP 4100N, Network Control Service Ver. 6.06
Fingerprint Ricoh Aficio SP 4100N printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_4100n auto
SEQ(SP=CA-D8%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# RICOH Aficio SP 4100N printer
Fingerprint Ricoh Aficio SP 4100N printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_4100n auto
SEQ(SP=D0-DA%GCD=1-6%ISR=D6-E0%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Ricoh SP C210SF branded printer made by Brother for Ricoh
Fingerprint Ricoh Aficio SP C210SF printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_c210sf auto
SEQ(TI=I%CI=I%II=I%SS=O|S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=6D-77|A9-B3%TG=80|FF%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6D-77%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=83F6%RUD=G)
IE(DFI=N%T=6D-77%TG=80%CD=Z)

# Ricoh Aficio SP C240SF
Fingerprint Ricoh Aficio SP C240SF printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_c240sf auto
SEQ(SP=CC-D6%GCD=1-6%ISR=D6-E0%TI=I%II=I%SS=O%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=12F-139%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=B0-BA%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=B0-BA%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=857D%RUD=G)
IE(DFI=N%T=B0-BA%TG=FF%CD=Z)

# Ricoh Aficio SP C311N
Fingerprint Ricoh Aficio SP C311N printer (VxWorks)
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_c311n auto
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=94-9E%GCD=1-6%ISR=9A-A4%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5B4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5B4%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=5B4%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# RICOH Aficio SP C420DN printer
Fingerprint Ricoh Aficio SP C420DN printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:aficio_sp_c420dn auto
SEQ(SP=C0-E4%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Ricoh MP W6700 Plotter
Fingerprint Ricoh MP W6700 printer
Class Ricoh | embedded || printer
CPE cpe:/h:ricoh:mp_w6700 auto
SEQ(SP=D2-DC%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M578NW0NNT01%O3=M280NW0NNT01%O4=M22CNW0NNT01%O5=M218NW0NNT01%O6=M109NNT01)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Rigol DS1054z Oscilloscope
Fingerprint Rigol DS1000Z-series oscilloscope
Class Rigol Technologies | embedded || specialized
SEQ(SP=F7-109%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Rigol DS1000Z series Oscilloscope
Fingerprint Rigol DS1000Z-series oscilloscope
Class Rigol Technologies | embedded || specialized
SEQ(SP=F6-100%GCD=1-6%ISR=104-10E%TI=I%CI=I|RI%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=111C%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Rigol Technologies DSG3060 Signal Generator
Fingerprint Rigol DSG3060 signal generator
Class Rigol Technologies | embedded || specialized
CPE cpe:/h:rigol_technologies:dsg3060
SEQ(SP=0-29%GCD=1-6|4F0|4F5|9E0|9EA|ED0|EDF|13C0|13D4|18B0|18C9%ISR=68-72%TI=I%CI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# BlackBerry 10 (BBOS 10, on a BlackBerry Z10 handset; based on QNX 6.6, like TabletOS). Not the same as "BlackBerry Tablet OS", though both are based on QNX: https://en.wikipedia.org/wiki/BlackBerry_10, https://en.wikipedia.org/wiki/BlackBerry_Tablet_OS --Ed.
# Blackberry OS10.1.0.xxxx
Fingerprint BlackBerry 10
Class RIM | BlackBerry | 10.X | phone
CPE cpe:/o:blackberry:blackberry_os:10.0
SEQ(SP=EE-10C%GCD=1-6%ISR=FF-113%TI=I%CI=I%II=I%SS=S%TS=0|1|3)
OPS(O1=M5B4NW1NNT11SNN|M5B4NW2NNT11SNN|M5B4NW3NNT11SNN|M5B4NW4NNT11SNN|M5B4NW6NNT11SNN%O2=M5B4NW1NNT11SNN|M5B4NW2NNT11SNN|M5B4NW3NNT11SNN|M5B4NW4NNT11SNN|M5B4NW6NNT11SNN%O3=M5B4NW1NNT11|M5B4NW2NNT11|M5B4NW3NNT11|M5B4NW4NNT11|M5B4NW6NNT11%O4=M5B4NW1NNT11SNN|M5B4NW2NNT11SNN|M5B4NW3NNT11SNN|M5B4NW4NNT11SNN|M5B4NW6NNT11SNN%O5=M5B4NW1NNT11SNN|M5B4NW2NNT11SNN|M5B4NW3NNT11SNN|M5B4NW4NNT11SNN|M5B4NW6NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SNN|M5B4NW2SNN|M5B4NW3SNN|M5B4NW4SNN|M5B4NW6SNN%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11SNN|M5B4NW2NNT11SNN|M5B4NW3NNT11SNN|M5B4NW4NNT11SNN|M5B4NW6NNT11SNN%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# BlackBerry OS 10.3.1.1779
Fingerprint BlackBerry 10
Class RIM | BlackBerry | 10.X | phone
CPE cpe:/o:blackberry:blackberry_os:10.0
SEQ(SP=100-10A%GCD=1-6%ISR=108-112%TI=I%CI=I%TS=1)
OPS(O1=M5B4NW6NNT11SNN%O2=M5B4NW6NNT11SNN%O3=M5B4NW6NNT11%O4=M5B4NW6NNT11SNN%O5=M5B4NW6NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW6SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW6NNT11SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=D413%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# BlackBerry OS 10
Fingerprint BlackBerry 10
Class RIM | BlackBerry | 10.X | phone
CPE cpe:/o:rim:blackberry:10 auto
SEQ(SP=FF-109%GCD=1-6%ISR=101-10B%TI=I%CI=I|RD%II=I%SS=S%TS=1|4)
OPS(O1=M5B4NW6NNT11SNN%O2=M5B4NW6NNT11SNN%O3=M5B4NW6NNT11%O4=M5B4NW6NNT11SNN%O5=M5B4NW6NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW6SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW6NNT11SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Blackberry OS 10.3.1.2582
Fingerprint BlackBerry 10.3
Class RIM | BlackBerry | 10.X | phone
CPE cpe:/o:rim:blackberry:10.3 auto
SEQ(SP=100-10A%GCD=1-6%ISR=108-112%TS=1)
OPS(O1=M5B4NW6NNT11SNN%O2=M5B4NW6NNT11SNN%O3=M5B4NW6NNT11%O4=M5B4NW6NNT11SNN%O5=M5B4NW6NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW6SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# BlackBerry OS 7.1
Fingerprint BlackBerry 7.1
Class RIM | BlackBerry | 7.X | phone
CPE cpe:/o:rim:blackberry:7.1 auto
SEQ(SP=1D-35%GCD=1000|2000|3000|4000|5000%ISR=AB-B5%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M550W3L%O2=M550W3L%O3=M280W3L%O4=M550W3L%O5=M218W3L%O6=M109)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=FFFF)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=0%O=%CC=S%Q=R)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=T00LL%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(R=N)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# BlackBerry Tablet OS 2
Fingerprint BlackBerry Tablet OS 2
Class RIM | Tablet OS | 2.X | media device
CPE cpe:/o:rim:tablet_os:2 auto
SEQ(SP=101-10B%GCD=1-6%ISR=102-10C%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW2NNT01SNN%O2=M5B4NW2NNT01SNN%O3=M5B4NW2NNT01%O4=M5B4NW2NNT01SNN%O5=M5B4NW2NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW2SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Model: Blackberry Playbook OS Version: 2.0.0.7971
# BlackBerry Playbook OS 2.0.1.358
Fingerprint BlackBerry Tablet OS 2.0
Class RIM | Tablet OS | 2.X | media device
CPE cpe:/h:rim:blackberry_playbook_tablet
CPE cpe:/o:rim:blackberry_playbook_os:2.0
SEQ(SP=EE-10C%GCD=1-6%ISR=103-113%TI=I%CI=I%II=I%SS=S%TS=0|1)
OPS(O1=M5B4NW1NNT01SNN|M5B4NW2NNT01SNN|M5B4NW3NNT01SNN|M5B4NW4NNT01SNN%O2=M5B4NW1NNT01SNN|M5B4NW2NNT01SNN|M5B4NW3NNT01SNN|M5B4NW4NNT01SNN%O3=M5B4NW1NNT01|M5B4NW2NNT01|M5B4NW3NNT01|M5B4NW4NNT01%O4=M5B4NW1NNT01SNN|M5B4NW2NNT01SNN|M5B4NW3NNT01SNN|M5B4NW4NNT01SNN%O5=M5B4NW1NNT01SNN|M5B4NW2NNT01SNN|M5B4NW3NNT01SNN|M5B4NW4NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SNN|M5B4NW2SNN|M5B4NW3SNN|M5B4NW4SNN%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT01SNN|M5B4NW2NNT01SNN|M5B4NW3NNT01SNN|M5B4NW4NNT01SNN%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# PlayBook OS 2.1.0.1753
Fingerprint BlackBerry Tablet OS 2.1
Class RIM | Tablet OS | 2.X | media device
CPE cpe:/o:rim:tablet_os:2.1 auto
SEQ(SP=FE-108%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=0|1)
OPS(O1=M5B4NW4NNT01SNN%O2=M5B4NW4NNT01SNN%O3=M5B4NW4NNT01%O4=M5B4NW4NNT01SNN%O5=M5B4NW4NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# DNNA RioKarma, MP3 player
Fingerprint Rio Karma media player
Class Rio | embedded || media device
SEQ(SP=89-9D%GCD=1-6%ISR=93-A1%TI=RD%CI=RD%II=RI%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=4470%W2=41A0%W3=4100%W4=4470%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=402E%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=3401%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Risc OS 4.39 on an Acorn A7000+ running an FTP server.
# RISC OS Version 4.39
Fingerprint RISCOS Ltd RISC OS 4.39
Class RISCOS Ltd | RISC OS | 4.X | general purpose
CPE cpe:/o:riscosltd:risc_os:4.39 auto
SEQ(SP=93-9D%GCD=1-6%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4180%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# 5.23
Fingerprint RISCOS Ltd RISC OS 5.23
Class RISCOS Ltd | RISC OS | 5.X | general purpose
CPE cpe:/o:riscosltd:risc_os:5.23 auto
SEQ(SP=2A-4A%GCD=1-6%ISR=8A-94%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4180%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Acorn RiscPC running Risc OS Select 6.20 (kernel 10.62) softloaded over Risc OS Adjust 4.39
Fingerprint RISCOS Ltd RISC OS 6.20
Class RISCOS Ltd | RISC OS | 6.X | general purpose
CPE cpe:/o:riscosltd:risc_os:6.20
SEQ(SP=90-9A%GCD=1-6%ISR=96-A0%TI=I|RD%CI=I%II=I%SS=S%TS=1)
OPS(O1=NNT11|M5B4NW0NNT11%O2=NNT11|M5B4NW0NNT11%O3=NNT11|M5B4NW0NNT11%O4=NNT11|M5B4NW0NNT11%O5=NNT11|M5B4NW0NNT11%O6=NNT11|M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4180%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=|M5B4NW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Riverbed Steelhead 200
Fingerprint Riverbed Steelhead 200 proxy server
Class Riverbed | embedded || proxy server
CPE cpe:/h:riverbed:steelhead_200
SEQ(SP=C9-D3%GCD=1-6%ISR=C7-D1%TI=Z%II=I%TS=A)
OPS(O1=M550ST11NW2%O2=M550ST11NW2%O3=M550NNT11NW2%O4=M550ST11NW2%O5=M550ST11NW2%O6=M550ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M550NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

Fingerprint Riverbed Steelhead proxy server
Class Riverbed | embedded || proxy server
SEQ(SP=C3-CD%GCD=1-6%ISR=C2-CC%TI=Z%CI=I%II=I%TS=A)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NW2NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Riverbed RIOS
Fingerprint Riverbed RiOS
Class Riverbed | RiOS || specialized
CPE cpe:/o:riverbed:rios
SEQ(SP=C3-CD%GCD=1-6%ISR=C1-CB%TI=Z%CI=I%II=I%TS=A)
OPS(O1=M55BST11NW2%O2=M55BST11NW2%O3=M55BNNT11NW2%O4=M55BST11NW2%O5=M55BST11NW2%O6=M55BST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M55BNNSNW2%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M55BST11NW2%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Riverbed Mobile Controller, model 8550 / 4.0.3 (i386)
Fingerprint Riverbed Steelhead Mobile Controller 4.0.3
Class Riverbed | RiOS || specialized
CPE cpe:/o:riverbed:rios auto
SEQ(SP=C6-D0%GCD=1-6%ISR=C9-D3%TI=Z%CI=I|RD%II=I%TS=A)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NW2NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Roberts Stream 202 internet radio
Fingerprint Roberts STREAM 202 Internet radio
Class Roberts | embedded || media device
CPE cpe:/h:roberts:stream_202
SEQ(SP=0-61%GCD=1-6|DB8D3|DB8D6|1B71A6|1B71AC|292A79|292A82|36E34C|36E358|449C1F|449C2E%ISR=B4-BE%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0-FFFF%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=28-40%TG=40%CD=S)

# 1756-EN2TR ControlLogix Ethernet/IP Adapter Device Level Ring Version 10.007
Fingerprint Rockwell Automation 1756 ControlLogix Ethernet/IP adapter
Class Rockwell Automation | embedded || specialized
SEQ(SP=90-9A%GCD=1-6%ISR=92-9C%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# 1756-L83E ControlLogix Processor Version 28.013
Fingerprint Rockwell Automation 1756-L8xE ControlLogix processor
Class Rockwell Automation | embedded || specialized
SEQ(SP=FC-106%GCD=1-6%ISR=103-10D%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Rockwell Automation 1761-NET-ENI EtherNet/IP to RS-232-C Interface Module
Fingerprint Rockwell Automation 1761-NET-ENI Ethernet-to-RS-232-C interface module
Class Rockwell Automation | embedded || specialized
CPE cpe:/h:rockwellautomation:1761-net-eni
SEQ(R=N)
OPS(O1=M400%O2=M400%O3=M400%O4=%O5=%O6=)
WIN(W1=FF%W2=FF%W3=FF%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Rockwell Automation 1761-NET-ENI
Fingerprint Rockwell Automation 1761-NET-ENI Ethernet-to-RS-232-C interface module
Class Rockwell Automation | embedded || specialized
CPE cpe:/h:rockwellautomation:1761-net-eni
SEQ(SP=35-3F%GCD=100|200|300|400|500%ISR=8B-95%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=FF%W2=FF%W3=FF%W4=FF%W5=FF%W6=FF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FF%O=M400%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FF%S=Z%A=S+%F=AS%O=M400%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Rockwell 1769-L23E-QB1 PLC
Fingerprint Rockwell Automation 1769-L23E-QB1 PLC
Class Rockwell Automation | embedded || specialized
CPE cpe:/h:rockwellautomation:1769-l23e-qb1
SEQ(SP=96-A0%GCD=1-6%ISR=9C-A6%TI=I|RD%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=|M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Logix EtherNet/IP module for Allen-Bradley PLC
Fingerprint Rockwell Automation Logix EtherNet/IP module
Class Rockwell Automation | embedded || specialized
SEQ(SP=92-A0%GCD=1-6%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM592SNW0%O2=NNM592SNW0%O3=M592NW0%O4=NNM592SNW0%O5=NNM592SNW0%O6=NNM592S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM592SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Roku HD1500 high definition network streaming appliance.
Fingerprint Roku HD1500 media player
Class Roku | embedded || media device
CPE cpe:/h:roku:soundbridge_m1500
SEQ(SP=BB-C5%GCD=1-6%ISR=BE-C8%TI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=M5B4ST11NW0%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=41%TG=40%W=16D0%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=41%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=100%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=100%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=100%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=100%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=100%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=100%TG=FF%CD=S)

# Roku SoundBridge 1001, running software version 3.0.44
Fingerprint Roku SoundBridge M1001 music player
Class Roku | embedded || media device
CPE cpe:/h:roku:soundbridge_m1001
SEQ(SP=10-1A%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M108)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Roku Soundbridge Radio software version 3.0.44
# Roku SoundBridge M500 running software version 3.0.44
# Roku Soundbridge model M1000 firmware 3.0.44
Fingerprint Roku SoundBridge M500 or M1000 music player
Class Roku | embedded || media device
CPE cpe:/h:roku:soundbridge_m500
CPE cpe:/h:roku:soundbridge_m1000
SEQ(SP=F-89%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=99-DB%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M108)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# RSA SecurID Appliance
Fingerprint RSA SecurID authentication appliance
Class RSA | embedded || specialized
CPE cpe:/h:rsa:securid
SEQ(SP=C6-D0%GCD=1-6%ISR=C9-D3%TI=RD%CI=Z%II=I%TS=U)
OPS(O1=M514NW0NNS%O2=M514NW0NNS%O3=M514NW0NNS%O4=M514NW0NNS%O5=M514NW0NNS%O6=M514NNS)
WIN(W1=AC8|16D0%W2=AC8|16D0%W3=AC8|16D0%W4=AC8|16D0%W5=AC8|16D0%W6=AC8|16D0)
ECN(R=Y%DF=Y%T=3E%TG=40%W=AC8|16D0%O=M514NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3E%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3E%TG=40%W=AC8|16D0%S=O%A=S+%F=AS%O=M514NW0NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3E%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3F%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40%TG=40%CD=S)

# Ruckus 7363 Multimedia Hotzone Wireless AP [Linux --Ed.]
Fingerprint Ruckus 7363 WAP
Class Ruckus | embedded || WAP
CPE cpe:/h:ruckus:7363 auto
SEQ(SP=C4-CE%GCD=1-6%ISR=CD-D7%TI=Z%II=I%TS=A)
OPS(O1=M574ST11NW1%O2=M574ST11NW1%O3=M574NNT11NW1%O4=M574ST11NW1%O5=M574ST11NW1%O6=M574ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M574NNSNW1%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ruckus Wireless Zone Director model ZD1050 [Linux --Ed.]
Fingerprint Ruckus ZD1050 WAP
Class Ruckus | embedded || WAP
CPE cpe:/h:ruckus:zd1050 auto
SEQ(SP=C9-D3%GCD=1-6%ISR=CE-D8%TI=Z%CI=I%II=I%TS=A)
OPS(O1=M5B4ST11NW3%O2=M5B4ST11NW3%O3=M5B4NNT11NW3%O4=M5B4ST11NW3%O5=M5B4ST11NW3%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ruckus ZoneFlex R710 Access Point Firmware Version : 3.4.0.1.1355
Fingerprint Ruckus ZoneFlex R710 WAP (Linux 3.4)
Class Ruckus | embedded || WAP
CPE cpe:/h:ruckus:zoneflex_r710 auto
Class Linux | Linux | 3.X | general purpose
CPE cpe:/o:linux:linux_kernel:3.4 auto
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=Z%CI=I|RD%II=RI%TS=A)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# RuggedCom Switch, ROS v3.11.0 Device: RSG-2288
# RuggedCom RuggedSwitch ROS (Rugged Operating System) 3.11.0
# RuggedCom Rugged Switch ROS version 3.8.2
Fingerprint RuggedCom RSG2288 switch (ROS 3.8.2 - 3.11)
Class RuggedCom | ROS | 3.X | switch
CPE cpe:/o:ruggedcom:ros:3 auto
SEQ(SP=F2-108%GCD=1-6%ISR=105-10F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=37-41%TG=40%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=111C%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=60%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# 2.6.32.13-Cavium-Octeon (ngcf@ngcf193) (gcc version 4.3.3 (Cavium Networks Version: 2_0_0 build 95) ) #1 SMP Thu Oct 8 14:18:21
Fingerprint Ruijie N18010 switch (Linux 2.6.32)
Class Ruijie | embedded || switch
CPE cpe:/h:ruijie:n18010 auto
Class Linux | Linux | 2.6.X | switch
CPE cpe:/o:linux:linux_kernel:2.6.32 auto
SEQ(SP=FE-108%GCD=1-6%ISR=107-111%TI=RD%CI=I%II=I%TS=7|9)
OPS(O1=M588ST11NW0%O2=M588ST11NW0%O3=M588NNT11NW0%O4=M588ST11NW0%O5=M588ST11NW0%O6=M588ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M588NNSNW0%CC=Y%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M588ST11NW0%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ruijie (no other details, but other than having a more common MSS it is identical to the other with this name. --Ed.)
Fingerprint Ruijie N18010 switch (Linux 2.6.32)
Class Ruijie | embedded || switch
CPE cpe:/h:ruijie:n18010 auto
Class Linux | Linux | 2.6.X | switch
CPE cpe:/o:linux:linux_kernel:2.6.32 auto
SEQ(SP=F9-103%GCD=1-6%ISR=103-10D%CI=I%II=I%TS=7)
OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=M5B4ST11NW0%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW0%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# DSL router SAGEM F@st 3302, unknown firmware
Fingerprint Sagem F@st 3302 DSL router
Class Sagem Communication | embedded || broadband router
SEQ(SP=14-1E%GCD=7A00|F400|16E00|1E800|26200|2DC00%ISR=91-9B%TI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=N)
T1(R=Y%DF=N%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# Sagem F@ST 3302 (C-BOX Upgraded to AliceBox)
Fingerprint Sagem F@st 3302 DSL router
Class Sagem Communication | embedded || broadband router
SEQ(SP=14-1E%GCD=7A00|F400|16E00|1E800|26200%ISR=90-9A%TI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# belgacom b-box 3
Fingerprint Sagemcom b-box 3 modem
Class Sagem Communication | embedded || broadband router
CPE cpe:/h:sagem:b-box_3
SEQ(SP=C5-CF%GCD=1-6%ISR=CD-D7%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B0NNSNW2%O2=M5B0NNSNW2%O3=M5B0NW2%O4=M5B0NNSNW2%O5=M5B0NNSNW2%O6=M5B0NNS)
WIN(W1=16C0%W2=16C0%W3=16C0%W4=16C0%W5=16C0%W6=16C0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16C0%O=M5B0NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16C0%S=O%A=S+%F=AS%O=M5B0NNSNW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SAGEM My Dual Radio 700
Fingerprint Sagem My du@l radio 700 Internet radio
Class Sagem Communication | embedded || media device
SEQ(R=N)
OPS(O1=M5B4%O2=%O3=%O4=%O5=%O6=)
WIN(W1=4470%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sagemcom Gigaset SE681 WiMAX router
Fingerprint Sagemcom Gigaset SE681 WiMAX router
Class Sagemcom | embedded || bridge
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# OS name: bada OS 1.2 device type: smartphone
Fingerprint Samsung Bada 1.2
Class Samsung | Bada | 1.X | phone
CPE cpe:/o:samsung:bada:1.2 auto
SEQ(SP=ED-109%GCD=1-6%ISR=FB-10D%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=E000%W2=E000%W3=E000%W4=E000%W5=E000%W6=E000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=E000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=E000%S=O%A=S+%F=AS%O=M5B4NW0NNT11NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Samsung GT-S5380
Fingerprint Samsung Bada 2.0
Class Samsung | Bada | 2.X | phone
CPE cpe:/o:samsung:bada:2.0 auto
SEQ(SP=F7-101%GCD=1-6%ISR=FA-104%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NW0NNT11NNS)
WIN(W1=E000%W2=E000%W3=E000%W4=E000%W5=E000%W6=E000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=E000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=E000%S=O%A=S+%F=AS%O=M5B4NW0NNT11NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Samsung LE32B651 LCD TV with embedded lan card
Fingerprint Samsung LE32B651 TV
Class Samsung | embedded || media device
CPE cpe:/h:samsung:le32b651
SEQ(SP=FA-104%GCD=1-6%ISR=103-10D%TI=I%CI=Z%II=I%SS=O%TS=7)
OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5B4NW8ST11%O6=M5B4ST11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=2000%O=M5B4NW8NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Samsung DB40E
Fingerprint Samsung SMART Signage Platform
Class Samsung | embedded || media device
SEQ(SP=F9-103%GCD=1-6%ISR=108-112%TI=Z%CI=RD%II=I%TS=U)
OPS(O1=M5B4NNSNW7%O2=M5B4NNSNW7%O3=M5B4NW7%O4=M5B4NNSNW7%O5=M5B4NNSNW7%O6=M5B4NNS)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=37-41%TG=40%W=4000%O=M5B4NNSNW7%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=4000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=164%UN=0%RIPL=G%RID=0%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=S)

# Samsung C460 Series
Fingerprint Samsung C460-series printer
Class Samsung | embedded || printer
SEQ(SP=91-9B%GCD=1-6%ISR=96-A0%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung CLX-3175FW
# Samsung CLP-310N printer
# Pinter model 6110
Fingerprint Samsung CLP-310N or CLX-3175RW, or Xerox Phaser 6110 printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clp-310n
CPE cpe:/h:samsung:clx-3175rw
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_6110
SEQ(SP=0-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=94-9E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Samsung CLP-315W Color Laser Printer
Fingerprint Samsung CLP-315W printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clp-315w auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Printer Samsung CLP320N Main Firmware Version: V1.20.01.19.N May-10-2010
Fingerprint Samsung CLP-320N printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clp-320n auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Samsung Model Name :    CLP-610
Fingerprint Samsung CLP-610ND printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clp-610nd
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Xerox Phaser 3300MFP. Operating System  OS 1.50.00.14 07-16-2009, Networking V4.02.06(P3300MFP) 07-16-2009.
# Samsung ML-2580N printer
# Samsung CLX-6220FX - Multipurpose Color Laserjet
# Samsung CLX3185 network Printer
# Samsung ML3312-ND printer
# Samsung ML-1865W Series laser printer
# Xerox WorkCentre 3550 Firmware Version : 25.002.04.001
# CLP-620ND colour laser printer
Fingerprint Samsung CLP-620ND, CLX-3185, CLX-6220FX, ML-1865W, ML-2580N, or ML-3312ND; or Xerox Phaser 3300MFP printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clx-3185
CPE cpe:/h:samsung:clx-6220fx
CPE cpe:/h:samsung:ml-1865w
CPE cpe:/h:samsung:ml-2580n
CPE cpe:/h:samsung:ml-3312nd
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_3300
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Printer Laser Color: Samsung Color-Expression CLP-770ND
Fingerprint Samsung CLP-770ND printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clp-770nd
SEQ(SP=4C-AE%GCD=1-6|7|E|15|1C|23%ISR=97-AB%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung CLX-3160FN Colour Laser Multi-Function
Fingerprint Samsung CLX-3160FN printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clx-3160fn auto
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Samsung CLX-3185FW
Fingerprint Samsung CLX-3185FW printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clx-3185fw auto
SEQ(SP=1-B%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=94-9E%TI=I%CI=I%TS=U)
OPS(O1=NNM5B0SNW0%O2=NNM5B0SNW0%O3=M5B0NW0%O4=NNM5B0SNW0%O5=NNM5B0SNW0%O6=NNM5B0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=NNM5B0SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung CLX-6220 Printer
# Xerox Phaser 3635MFP System Software Version: 20.104.05.003
# Samsung SCX-5835_5935
Fingerprint Samsung CLX-6220 or SCX-5835 or Xerox Phaser 3635MFP or 4600 printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:clx-6220
CPE cpe:/h:samsung:scx-5835
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_3635mfp
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=NNM5B4SNW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung M2020W Wireless Printer
Fingerprint Samsung M2020W wireless printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:m2020w auto
SEQ(CI=BI%TS=U)
OPS(O1=M5A0NW0%O2=M5A0NW0%O3=M5A0NW0%O4=M5A0NW0%O5=M5A0NW0%O6=M5A0)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5A0NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# M283x Series laser printer
# Samsung Xpress M2675FN Firmware: V3.00.01.29 DEC-24-2014, Network Firmware: 6.01.00, IP Core Version: 22.01.NW Stack Version
Fingerprint Samsung M267x or M283x series printer
Class Samsung | embedded || printer
SEQ(SP=8A-D4%GCD=1-6%ISR=96-C2%TI=BI|RD%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung M2825
Fingerprint Samsung M2825 printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:m2825 auto
SEQ(SP=91-9B%GCD=1-6%ISR=92-9C%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung ML-1865W wireless printer on local lan.
Fingerprint Samsung ML-1865W printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:ml-1865w auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung ML-371x Series
Fingerprint Samsung ML-371x Series printer
Class Samsung | embedded || printer
SEQ(SP=92-9C%GCD=1-6%ISR=96-A0%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung SCX-3405FW Firmware version V3.00.01.08     NOV-21-2011
# Samsung CLX-3305FW MFC printer
# Samsung-ML-451x-501x-Series
Fingerprint Samsung SCX-3405FW, CLX-3305FW, or ML-451x-501x-Series printer
Class Samsung | embedded || printer
CPE cpe:/h:samsung:scx-3405fw auto
CPE cpe:/h:samsung:clx-3305fw auto
SEQ(SP=84-B2%GCD=1-6%ISR=92-AC%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1000%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# SCX-4x24 Series
Fingerprint Samsung SCX-4x24-series printer
Class Samsung | embedded || printer
SEQ(SP=0-5%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=94-9E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SCX-4x28 Series printer
Fingerprint Samsung SCX-4x28-series printer
Class Samsung | embedded || printer
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Samsung OfficeServ 7100 Phone System
Fingerprint Samsung OfficeServ 7100 VoIP adapter
Class Samsung | embedded || VoIP adapter
CPE cpe:/h:samsung:officeserv_7100 auto
SEQ(SP=E3-105%GCD=1-6%ISR=FC-108%TI=Z%CI=RI%II=I%TS=7|9)
OPS(O1=M576ST11NW2%O2=M576ST11NW2%O3=M280NNT11NW2%O4=M22CST11NW2%O5=M218ST11NW2%O6=M109ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M576NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Samsung Office Serve 7200 Phone System
# GatesAir FlexStar HDx-FM HD radio/FM broadcast exciter v8.45 (Scanning can brick this device)
Fingerprint Samsung OfficeServ 7200 VoIP adapter or Harris FlexStar HD radio/FM broadcast exciter
Class Samsung | embedded || VoIP adapter
CPE cpe:/h:samsung:officeserv_7200 auto
Class Harris | embedded || specialized
CPE cpe:/h:harris:flexstar_hdx-fm
SEQ(SP=100-10A%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=111C|3354%W2=111C|3354%W3=111C|3354%W4=111C|3354%W5=111C|3354%W6=111C|3354)
ECN(R=Y%DF=N%T=37-3D%TG=40%W=111C|3354%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-3D%TG=40%W=111C|3354%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=37-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-3D%TG=40%IPL=150%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-3D%TG=40%CD=Z)

# Samsung i5220 internet phone firmware version 1.43
# Samsung OfficeServ SMT-i3100
Fingerprint Samsung SMT-i5220 or SMT-i3100 VoIP phone
Class Samsung | embedded || VoIP phone
CPE cpe:/h:samsung:smt-i5220 auto
SEQ(SP=8C-AE%GCD=1-6%ISR=97-AB%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=NNM5A0SNW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Samsung i8910 HD phone, running Symbian 9.4, S60 5th Edition.
Fingerprint Samsung i8910 mobile phone (Symbian OS 9.4)
Class Samsung | Symbian OS | 9.X | phone
CPE cpe:/o:samsung:symbian_os:9.4 auto
SEQ(SP=A2-B0%GCD=1-6%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=14)
OPS(O1=M5B4NNT11NW0NNS%O2=M5B4NNT11NW0NNS%O3=M5B4NNT11NW0%O4=M5B4NNT11NW0NNS%O5=M5B4NNT11NW0NNS%O6=M5B4NNT11NNS)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=FAF0%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=FAF0%S=O%A=S+%F=AS%O=M5B4NNT11NW0NNS%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Wireless Internet Radio from Sandstrøm Chipset: Frontier Silicon OS: Jupiter 6.2
Fingerprint Sandstrom Internet Radio
Class Sandstrom | embedded || media device
SEQ(SP=65-75%GCD=1-6%ISR=A4-AE%TI=I|RD%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=4000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=O%A=O|S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=4000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=461E|6E63%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=29-3F%TG=40%CD=S)

# Sanyo PLC-XU88 network-attached video projector.
Fingerprint Sanyo PLC-XU88 digital video projector
Class Sanyo | embedded || media device
CPE cpe:/h:sanyo:plc-xu88
SEQ(SP=0-93%GCD=1000|2000|3000|4000|5000%ISR=36-EA%TI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=80%W2=80%W3=80%W4=80%W5=80%W6=80)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(R=N)

# custom operating system for our IP clock devices
Fingerprint Sapling IP clock
Class Sapling | embedded || specialized
SEQ(SP=5-F%GCD=FFF7|1FFEE|2FFE5|3FFDC|4FFD3%ISR=94-9E%TI=RD%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2238%W2=2238%W3=2238%W4=2238%W5=2238%W6=2238)
ECN(R=N)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Satel ETHM-2 module
Fingerprint Satel ETHM-2 intruder alarm
Class Satel | embedded || security-misc
CPE cpe:/h:satel:ethm-2
SEQ(SP=0-BF%GCD=1-6|>1000000%ISR=E3-ED%TI=Z%CI=Z%II=RI%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=5DC%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=5DC%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=5DC%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=5DC%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=22-3E%TG=40%CD=S)

Fingerprint Schneider Electric ION8600 smart meter
Class Schneider Electric | embedded || specialized
SEQ(SP=1B-25%GCD=F8|1F0|2E8|3E0|4D8%ISR=8A-94%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=37-41%TG=40%W=111C%O=%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=111C%S=O%A=S+%F=AS%O=%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# TSX ETY PORT Web Server made by Schneider Electric.
Fingerprint Schneider Electric TSX ETY programmable logic controller
Class Schneider Electric | embedded || specialized
CPE cpe:/h:schneiderelectric:tsx_ety
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%CI=I%II=I%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Schrack smart meter with a Variomod XC (ethernet) module, which itself is a clone of http://www.emh-meter.de/de/produkte/lzqj-xc1/ LZQJ-XC.
Fingerprint Schrack electric meter
Class Schrack | embedded || power-device
SEQ(SP=C-20%GCD=28|50|78|A0|C8%ISR=42-4C%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5A6%O2=M5A6%O3=M5A6%O4=M5A6%O5=M5A6%O6=M5A6)
WIN(W1=7B8%W2=7B8%W3=7B8%W4=7B8%W5=7B8%W6=7B8)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=7B8%O=M5A6%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=A%A=S+%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=A%A=S+%F=AR%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S+%F=AR%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S+%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=A%A=S+%F=AR%RD=0)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SEL-2701 ethernet add on card
Fingerprint Schweitzer Engineering SEL-2701 Ethernet processor
Class Schweitzer Engineering | embedded || specialized
CPE cpe:/h:schweitzerengineering:sel-2701
SEQ(R=N)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Scientific Alanta WebSTAR DPC2100 v2.0.2r1242-040825
Fingerprint Scientific Atlanta WebSTAR DPC2100 cable modem
Class Scientific Atlanta | embedded || broadband router
CPE cpe:/h:scientificatlanta:webstar_dpc2100 auto
SEQ(SP=CD-D7%GCD=1-6%ISR=106-110%TI=RD%II=RI%TS=A)
OPS(O1=M5B4NW0NNT11SLL%O2=M5B4NW0NNT11SLL%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11SLL%O5=M5B4NW0NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FECC%W2=FECC%W3=FECC%W4=FECC%W5=FECC%W6=FECC)
ECN(R=Y%DF=Y%T=41%TG=40%W=FECC%O=M5B4NW0SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Scientific Atlanta (Cisco) Webstar DPC2100R2 Cable Modem
Fingerprint Scientific Atlanta WebSTAR DPC2100R2 cable modem
Class Scientific Atlanta | embedded || broadband router
CPE cpe:/h:scientificatlanta:webstar_dpc2100r2 auto
SEQ(SP=CC-D6%GCD=1-6%ISR=D8-E2%TI=Z%II=RI)
OPS(O1=M5B4NW3NNT11SNN%O2=M5B4NW3NNT11SNN%O3=M5B4NW3NNT11%O4=M5B4NW3NNT11SNN%O5=M5B4NW3NNT11SNN%O6=M5B4NNT11SNN)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3C-46%TG=40%W=8000%O=M5B4NW3SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=51AE%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# WebSTAR EPC2203 epc2203-E10-5-v202r1257-060605
Fingerprint Scientific Atlanta WebSTAR EPC2203 cable modem
Class Scientific Atlanta | embedded || broadband router
CPE cpe:/h:scientificatlanta:webstar_epc2203 auto
SEQ(SP=FE-108%GCD=1-6%ISR=106-110%TI=I%II=I%SS=S%TS=8)
OPS(O1=|NNT11|M5B4NW0NNT11%O2=|NNT11|M5B4NW0NNT11%O3=|NNT11|M5B4NW0NNT11%O4=|NNT11|M5B4NW0NNT11%O5=|NNT11|M5B4NW0NNT11%O6=|NNT11|M5B4NNT11)
WIN(W1=0|43E0%W2=0|4110%W3=0|423C%W4=0|4074%W5=0|4180%W6=0|403D)
ECN(R=Y%DF=N|Y%T=3B-45%TG=40%W=0|4470%O=|M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N|Y%T=3B-45%TG=40%S=O|Z%A=O|S+%F=A|AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N|Y%T=3B-45%TG=40%W=0|403D%S=O|Z%A=O|S+%F=A|AR|AS%O=|NNT11|M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SCO OpenServer 5
Fingerprint SCO OpenServer 5
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5 auto
SEQ(SP=FB-109%GCD=1-6%ISR=FE-10C%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=832C%W2=832C%W3=832C%W4=832C%W5=832C%W6=832C)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=832C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8058%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# SCO OpenServer 5.0.4
# SCO OpenServer, SCO_SV host 3.2 5.0.5 i386
# Unixware 7.0.1
# SCO OpenServer 5.0.2
Fingerprint SCO OpenServer 5.0.2 - 5.0.5
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5 auto
SEQ(SP=95-B7%GCD=1-6%ISR=A8-C0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=60F4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=6041%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO Open Server 5.05
Fingerprint SCO OpenServer 5.0.5
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5.0.5 auto
SEQ(SP=AD-B7%GCD=1-6%ISR=B7-C1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=108C%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO OpenServer (SCO_SV scosysv 3.2 5.0.7 i386) (VMWare)
# SCO OpenServer(TM) Release 5 (scosysv) (ttyp0), SCO_SV scosysv 3.2 5.0.7 i386 - on vmware
Fingerprint SCO OpenServer 5.0.7
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5.0.7 auto
SEQ(SP=FE-10C%GCD=1-6%ISR=102-10E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=832C%W2=832C%W3=832C%W4=832C%W5=832C%W6=832C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=832C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=8058%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO OpenServer 5.0.7 July 2005 CD1 Recut
Fingerprint SCO OpenServer 5.0.7
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5.0.7 auto
SEQ(SP=100-10A%GCD=1-6%ISR=106-110%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=111C%O=M5B4%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=108C%S=O%A=O%F=A%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO Open Server 5.0.7 (sysv 3.2r5.0.7) i386 Kernel 2003-02-18
Fingerprint SCO OpenServer 5.0.7 (x86)
Class SCO | OpenServer | 5.X | general purpose
CPE cpe:/o:sco:openserver:5.0.7 auto
SEQ(SP=F3-FF%GCD=1-6%ISR=102-10C%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=60F4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=6041%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO OpenServer 6.0 (VMware)
# SCO UnixWare 7.1.4
Fingerprint SCO OpenServer 6.0 or UnixWare 7.1.4
Class SCO | OpenServer | 6.X | general purpose
CPE cpe:/o:sco:openserver:6.0 auto
Class SCO | UnixWare | 7.X | general purpose
CPE cpe:/o:sco:unixware:7.1.4
SEQ(SP=A5-B9%GCD=1-6%ISR=B1-C3%TI=I%II=I%SS=S%TS=7|8)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=60F4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO_SV 3.2 2 i386
# SCO openserver 3.2/5.0.5 i386
Fingerprint SCO UNIX 3.2
Class SCO | SCO UNIX | 3.X | general purpose
CPE cpe:/o:sco:sco_unix:3.2 auto
SEQ(SP=AF-B9%GCD=1-6%ISR=B4-C2%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=6041%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# SCO Unix version 3.2
Fingerprint SCO UNIX 3.2
Class SCO | SCO UNIX | 3.X | general purpose
CPE cpe:/o:sco:sco_unix:3.2 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=37-41%TG=40%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=FFC%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SCO UNIX, SCO_SV 3.2v5.0.7 2003-02-18
Fingerprint SCO UNIX 3.2v5.0.7
Class SCO | SCO UNIX | 3.X | general purpose
CPE cpe:/o:sco:sco_unix:3.2v5.0.7 auto
SEQ(SP=FA-10C%GCD=1-6%ISR=106-110%TI=I%II=I%SS=S%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=M564%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=6019%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# UnixWare 2.1
Fingerprint SCO UnixWare 2.1
Class SCO | UnixWare | 2.X | general purpose
CPE cpe:/o:sco:unixware:2.1 auto
SEQ(SP=AE-B8%GCD=1-6%ISR=B2-C0%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# UnixWare 5 7.1.1 i386 x86at SCO UNIX_SVR5
Fingerprint SCO UnixWare 7.1.1
Class SCO | UnixWare | 7.X | general purpose
CPE cpe:/o:sco:unixware:7.1.1 auto
SEQ(SP=AC-B8%GCD=1-6%ISR=B4-BE%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=6041%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# SCO Unixware 7.1.3
Fingerprint SCO UnixWare 7.1.3
Class SCO | UnixWare | 7.X | general purpose
CPE cpe:/o:sco:unixware:7.1.3 auto
SEQ(SP=9D-B7%GCD=1-6%ISR=A3-BD%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=60F4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=6041%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SCO UnixWare 8.0.0
Fingerprint SCO UnixWare 8.0.0
Class SCO | UnixWare | 8.X | general purpose
CPE cpe:/o:sco:unixware:8.0.0 auto
SEQ(SP=A9-B9%GCD=1-6%ISR=B2-C0%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=60F4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Seagate Maxtor Central Axis Network Storage Server STM310005CAA00G or STM310005CAD00G
Fingerprint Seagate Maxtor Central Axis NAS device
Class Seagate | embedded || storage-misc
SEQ(SP=C4-CE%GCD=1-6%ISR=C8-D2%TI=Z%CI=I%II=I%TS=7)
OPS(O1=M1F1CST11NW1%O2=M1F1CST11NW1%O3=M1F1CNNT11NW1%O4=M1F1CST11NW1%O5=M1F1CST11NW1%O6=M1F1CST11)
WIN(W1=3E20%W2=3E20%W3=3E20%W4=3E20%W5=3E20%W6=3E20)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3E38%O=M1F1CNNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3E20%S=O%A=S+%F=AS%O=M1F1CST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Secure Computing Firewall (SecureOS) Version: "Sidewinder 6.1.1.05"
Fingerprint Secure Computing Sidewinder firewall (SecureOS 6.1.1.05)
Class Secure Computing | SecureOS | 6.X | firewall
CPE cpe:/o:securecomputing:secureos:6.1.1.05 auto
SEQ(SP=FD-10B%GCD=1-6%ISR=105-111%TI=RI%TS=1)
OPS(O1=M5B4NW4NNT11%O2=M5B4NW0NNT11%O3=M5B4NW4NNT11%O4=M5B4NW4NNT11%O5=M5B4NW4NNT11%O6=M5B4NNT11)
WIN(W1=4470%W2=41A0%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=402E%S=O%A=O|S+%F=AS%O=M5B4NW4NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Sidewinder G2 appliance running version 6.1.2.0.3
Fingerprint Secure Computing Sidewinder G2 firewall (SecureOS 6.1.2.0.3)
Class Secure Computing | SecureOS | 6.X | firewall
CPE cpe:/o:securecomputing:secureos:6.1.2.0.3 auto
SEQ(SP=100-10A%GCD=1-6%ISR=105-10F%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW4NNT11%O2=M5B4NW0NNT11%O3=M5B4NW4NNT11%O4=M5B4NW4NNT11%O5=M5B4NW4NNT11%O6=M5B4NNT11)
WIN(W1=4470%W2=41A0%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SecureOS 7.0.0.06 SW_OPS_SMP Mon Mar 31 15:47:25 CDT 2008 70006-b_0  i386
Fingerprint Secure Computing SecureOS 7.0.0.04
Class Secure Computing | SecureOS | 7.X | firewall
CPE cpe:/o:securecomputing:secureos:7.0.0.04 auto
SEQ(SP=FA-108%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNT11SLL%O2=M5B4NW0NNT11SLL%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11SLL%O5=M5B4NW0NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=O%A=S+%F=AS%O=M5B4NW0NNT11SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=BBE8%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Secure Computing Sidewinder Firewall (SecureOS 7.0.0.04)
Fingerprint Secure Computing Sidewinder firewall (SecureOS 7.0.0.04)
Class Secure Computing | SecureOS | 7.X | firewall
CPE cpe:/o:securecomputing:secureos:7.0.0.04 auto
SEQ(SP=FE-10D%GCD=1-6%ISR=103-10D%TI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNT11SLL%O2=M5B4NW0NNT11SLL%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11SLL%O5=M5B4NW0NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=O%A=S+%F=AS%O=M5B4NW0NNT11SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SEH InterCon Smart PrintServer, model IC105-FASTPOCKET-TX
Fingerprint SEH InterCon IC105 print server
Class SEH | embedded || print server
CPE cpe:/h:seh:intercon_ic105 auto
SEQ(SP=0-5%GCD=A|14|1E|28|32%ISR=30-3A%TI=I%CI=I%II=I%SS=O%TS=U)
OPS(O1=M558%O2=M558%O3=M558%O4=M558%O5=M558%O6=M558)
WIN(W1=5580%W2=5580%W3=2800%W4=2180%W5=2180%W6=1090)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5580%O=M558%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=105F3A3D%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=FEABB571%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=105F3A3D%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%RD=4FCBBE69)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=105F3A3D%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=FEABB571%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Seiko NS2232 Terminal/Communications Server
# Seiko Instruments NS2232 (terminal server) Firmware version 2.0B2
Fingerprint Seiko NS-2232 serial-to-IP bridge
Class Seiko | embedded || bridge
CPE cpe:/h:seiko:ns-2232
SEQ(SP=20-B0%GCD=1-6%ISR=7B-85%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=0|800%S=O|Z%A=O%F=A|AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-3D%TG=40%CD=S)

# Senao NL-2611CB3 Plus Deluxe, firmware version 2.0.2
Fingerprint Senao NL-2611CB3 PLUS WAP
Class Senao | embedded || WAP
CPE cpe:/h:senao:nl-2611cb3_plus
SEQ(SP=A5-AF%GCD=1-6%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# The device is a Sensatronics Temperature Monitor, model E4.
Fingerprint Sensatronics E4 temperature monitor
Class Sensatronics | embedded || specialized
CPE cpe:/h:sensatronics:e4
SEQ(SP=43-B7%GCD=200|400|600|800|A00|10000|20000|30000|40000|50000%ISR=10B-115%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=400%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sensatronics Model: EM1 Firmware Version: 5.3
Fingerprint Sensatronics EM1 environmental monitor
Class Sensatronics | embedded || specialized
CPE cpe:/h:sensatronics:em1
SEQ(SP=6A-7A%GCD=10000|20000|30000|40000|50000%ISR=10A-114%TI=I%II=I%SS=S%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M218%O5=M218%O6=M109)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=400%O=M230%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sequent Dynix.
Fingerprint Sequent DYNIX (BSD-based Unix)
Class Sequent | DYNIX || general purpose
CPE cpe:/o:sequent:dynix auto
SEQ(SP=0-5%GCD=61A8|C350|124F8|186A0|1E848%ISR=8A-94%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# SGI Indigo running IRIX 4.0.5F uname: IRIX 4.0.5F 08280217 IP20
Fingerprint SGI IRIX 4.0.5F
Class SGI | IRIX | 4.X | general purpose
CPE cpe:/o:sgi:irix:4.0.5f auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=EF88%W2=EB28%W3=F000%W4=F000%W5=EEB0%W6=EF1F)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=EF88%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF1F%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=F000%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 5.2 02282013 IP12 mips
Fingerprint SGI IRIX 5.2
Class SGI | IRIX | 5.X | general purpose
CPE cpe:/o:sgi:irix:5.2 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%CI=I%II=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=N%T=37-41%TG=40%W=EF88%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=37-41%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=F000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SGI 5.3 1109812 IP22 mips, SGI indy, R4600, 133MHz.  Fresh install of IRIX 5.3
Fingerprint SGI IRIX 5.3
Class SGI | IRIX | 5.X | general purpose
CPE cpe:/o:sgi:irix:5.3 auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=1|2)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=EF88%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=F000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 IRIS 6.5 04131233 IP26
Fingerprint IRIX64 IRIS 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5 10070056 IP32
# IRIX 6.5 07202013 IP32
Fingerprint SGI IRIX 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6.5 auto
SEQ(SP=36-46%GCD=3E8|7D0|BB8|FA0|1388|FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=EF88%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5 05190003 IP22
Fingerprint SGI IRIX 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6.5 auto
SEQ(SP=0-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=EF88%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5 6.5.15m 01091821 IP32
Fingerprint SGI IRIX 6.5.15m
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6.5.15m auto
SEQ(SP=C-9C%GCD=80|100|180|200|280|FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=EF88%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5.22m on an SGI Indigo2
# IRIX 6.5; uname: IRIX 6.5 6.5.22m IP22; on: Silicon Graphics Indigo2 Impact R4400
# IRIX 6.5 10070056 IP32
# IRIX 6.5 6.5.30f 07202013 IP32
Fingerprint SGI IRIX 6.5.22m - 6.5.30f
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=95-9F%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS|M2048NW0NNT11NNS%O2=M5B4NW0NNT11NNS|M2048NW0NNT11NNS%O3=M5B4NW0NNT11NNS|M2048NW0NNT11NNS%O4=M5B4NW0NNT11NNS|M2048NW0NNT11NNS%O5=M5B4NW0NNT11NNS|M2048NW0NNT11NNS%O6=M5B4NNT11NNS|M2048NNT11NNS)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=EF88%O=M5B4NW0NNS|M2048NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5 07202013 IP32 (6.5.30)
Fingerprint SGI IRIX 6.5.30
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6.5.30 auto
SEQ(SP=8A-94%GCD=1-6|8%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=EF88%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX 6.5 10181058 IP22, Indigo2 with a R4400 processor, running IRIX 6.5.6m.
Fingerprint SGI IRIX 6.5.6m
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6.5.6m auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=ED90%W2=EE90%W3=EDF4%W4=F000%W5=EF7C%W6=EF2A)
ECN(R=Y%DF=Y%T=3B%TG=40%W=EF88%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B%TG=40%W=EF2A%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FE%TG=FF%CD=S)

# IRIX64 iris11 6.5 04101931 IP30
Fingerprint SGI IRIX64 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=4E-C0%GCD=1-6|50|A0|F0|140|190%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 6.5 10181058 IP30
Fingerprint SGI IRIX64 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=58-62%GCD=50|A0|F0|140|190%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 6.5 07202013 IP30
Fingerprint SGI IRIX64 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=6D-77%GCD=10|20|30|40|50%ISR=98-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=38-42%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=38-42%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=38-42%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=100%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=100%TG=FF%CD=S)

# IRIX64 6.5 07202013 IP35
Fingerprint SGI IRIX64 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=3F-87%GCD=20|40|60|80|A0|320|640|960|C80|FA0%ISR=97-A1%CI=I%II=I%TS=1)
OPS(O1=M5B4NW2NNT11NNS%O2=M5B4NW2NNT11NNS%O3=M5B4NW2NNT11NNS%O4=M5B4NW3NNT11NNS%O5=M5B4NW2NNT11NNS%O6=M5B4NW2NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW2NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 6.5 07202013 IP35
Fingerprint SGI IRIX64 6.5
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=FE-10C%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW2NNT11NNS%O2=M5B4NW2NNT11NNS%O3=M5B4NW2NNT11NNS%O4=M5B4NW3NNT11NNS%O5=M5B4NW2NNT11NNS%O6=M5B4NW2NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW2NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SGI IRIX64 6.5.15m
# IRIX64 6.5 01091821 IP35
Fingerprint SGI IRIX64 6.5.15m
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=3E-8E%GCD=20|40|50|60|80|A0|C0|320|640|960|C80|FA0|12C0|1900|1F40|2580%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 6.5.19f 01100601 IP30
Fingerprint SGI IRIX64 6.5.19f
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=53-65%GCD=50|A0|F0|140|190%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# IRIX64 6.5.22f 10070055 IP30
Fingerprint SGI IRIX64 6.5.22f
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=57-C1%GCD=1-6|50|A0|F0|140|190%ISR=97-A1%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11NNS%O2=M5B4NW0NNT11NNS%O3=M5B4NW0NNT11NNS%O4=M5B4NW0NNT11NNS%O5=M5B4NW0NNT11NNS%O6=M5B4NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SGI Octane2 running IRIX uname: IRIX64 6.5 6.5.30m 07202013 IP30
Fingerprint SGI IRIX64 6.5.30m
Class SGI | IRIX | 6.X | general purpose
CPE cpe:/o:sgi:irix:6 auto
SEQ(SP=ED-109%GCD=1-6%ISR=105-10F%TI=I%TS=1|2)
OPS(O1=M5B4NW6NNT11NNS%O2=M5B4NW6NNT11NNS%O3=M5B4NW6NNT11NNS%O4=M5B4NW6NNT11NNS%O5=M5B4NW6NNT11NNS%O6=M5B4NW6NNT11NNS)
WIN(W1=C000%W2=C000%W3=C000%W4=C000%W5=C000%W6=C000)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C000%O=M5B4NW6NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=C000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Sharp AR-M351N Printer
# Sharp AR-C260M copier/printer
Fingerprint Sharp AR-C260M or AR-M351N printer
Class Sharp | embedded || printer
CPE cpe:/h:sharp:ar-c260m
CPE cpe:/h:sharp:ar-m351n
SEQ(SP=0-5A%GCD=1-6|10001|20002|30003|40004|50005|60006%ISR=94-9E%TI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=C00%W2=C00%W3=C00%W4=C00%W5=C00%W6=C00)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=C00%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=C00%S=A|O%A=O|S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=C00%S=A|O%A=O|S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=C00%S=A|O%A=O|S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A|O%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A|O%A=O|S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A|O%A=O|S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=FA-104%TG=FF%CD=Z)

# Sharp Network Printer AR-M236
Fingerprint Sharp AR-M236 printer
Class Sharp | embedded || printer
CPE cpe:/h:sharp:ar-m236 auto
SEQ(SP=0-5%GCD=6B6C|D6D8|14244|1ADB0|2191C%ISR=8B-95%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=O|S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Sharp AR-M237 printer.
Fingerprint Sharp AR-M237 printer
Class Sharp | embedded || printer
CPE cpe:/h:sharp:ar-m237 auto
SEQ(SP=0-5%GCD=61A8|C350|124F8|186A0|1E848%ISR=8A-94%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=2000%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# 4-port GSM-SIP gateway PORTech MV-374
# 2FXS VoIP gateway K-3288W
Fingerprint Shenzhen Kinoway K-3288W or PORTech MV-374 GSM-SIP VoIP adapter
Class Shenzhen Kinoway | embedded || VoIP adapter
CPE cpe:/h:shenzhen_kinoway:k-3288w
Class PORTech | embedded || VoIP adapter
CPE cpe:/h:portech:mv-374
SEQ(SP=0-5%GCD=61A8|C350|124F8|186A0|1E848%ISR=8A-94%TI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4|WANM5B4T10S%O2=M578|M578W0ST10L%O3=M280|T10NNW5NM280%O4=M5B4|ST10WAL%O5=M218|M218ST10WAL%O6=M109|M109ST10)
WIN(W1=0|3180%W2=0|3180%W3=0|3180%W4=0|3180%W5=0|3180%W6=0|3180)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=WANM5B4SNN%CC=N%Q=R)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# ShoreGear SG-8 phone switch
Fingerprint ShoreTel ShoreGear SG-8 VoIP switch
Class ShoreTel | embedded || VoIP adapter
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M550%O2=M550%O3=M550%O4=M550%O5=M550%O6=M550)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M550%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ShoreGear SG-t1k switch
Fingerprint ShoreTel ShoreGear SG-T1K VoIP switch
Class ShoreTel | embedded || VoIP adapter
SEQ(SP=FF-109%GCD=1-6%ISR=106-112%TI=I%CI=I%II=I%SS=S%TS=9)
OPS(O1=M550NW0NNT11%O2=M550NW0NNT11%O3=M550NW0NNT11%O4=M550NW0NNT11%O5=M550NW0NNT11%O6=M550NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M550NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M550NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ShoreTel Voice Switch 220T1A
Fingerprint ShoreTel Voice Switch 220T1A VoIP gateway
Class ShoreTel | embedded || VoIP adapter
CPE cpe:/h:shoretel:voice_switch_220t1a auto
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=I%CI=I%II=I%SS=S%TS=9)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Siemens C2-010-I ADSL2+ modem with firmware R100B01.0B_HN_20060406
Fingerprint Siemens C2-010-I ADSL modem
Class Siemens | embedded || broadband router
CPE cpe:/h:siemens:c2-010-i auto
SEQ(SP=F9-105%GCD=1-6%ISR=FF-109%TI=I%II=I%SS=O|S%TS=U)
OPS(O1=|M58C%O2=|M58C%O3=|M58C%O4=|M58C%O5=|M58C%O6=|M58C)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3E80%O=|M58C%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS|RF%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3E80%S=O%A=O|S+%F=AS|RF%O=|M58C%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=ARF%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Siemens Gigaset SE567 (local adsl router from TELUS Communications)
# Efficient Networks/Siemens Speedstream 4200
# Siemens 4200 ADSL2+ Modem / Router
# SpeedStream 4200 ADSL router
# SpeadStream 4200-series Firmware Part #:  004-D241-A0U
Fingerprint Siemens Gigaset SE567 WAP or SpeedStream 4200 ADSL modem
Class Siemens | embedded || broadband router
CPE cpe:/h:siemens:speedstream_4200
Class Siemens | embedded || WAP
CPE cpe:/h:siemens:gigaset_se567
SEQ(SP=F4-10A%GCD=1-6%ISR=EB-101%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SpeedStream 4200 router from Siemens.
Fingerprint Siemens SpeedStream 4200 ADSL modem
Class Siemens | embedded || broadband router
CPE cpe:/h:siemens:speedstream_4200 auto
SEQ(SP=E4-10E%GCD=1-6%ISR=DB-105%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# HiPath 3000 PABX
Fingerprint Siemens HiPath 3000 PBX
Class Siemens | embedded || PBX
CPE cpe:/h:siemens:hipath_3000
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M4B0NW0NNT11%O2=M4B0NW0NNT11%O3=M4B0NW0NNT11%O4=M4B0NW0NNT11%O5=M4B0NW0NNT11%O6=M4B0NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M4B0NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1E-36%TG=20|40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# AEM100 Version V3.6/6(010418)SIE
Fingerprint Siemens AEM100 remote management unit
Class Siemens | embedded || remote management
CPE cpe:/h:siemens:aem100
SEQ(SP=73-7D%GCD=1-6%ISR=90-9A%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=E00%W2=E00%W3=E00%W4=E00%W5=E00%W6=E00)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-3D%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=N%T=3B-3D%TG=40%CD=Z)

# Siemens LOGO! 0BA7 (with ethernet connection)
Fingerprint Siemens LOGO! 0BA7 PLC
Class Siemens | embedded || specialized
SEQ(SP=0-5%GCD=1955895|32AB12A|4C009BF|6556254|7EABAE9%ISR=DB-E5%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=1000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=1000%S=O%A=S+%F=AS%O=M200%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=1000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=1000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=1000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=1000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=5987%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Windows CE Telnet service on MP370
Fingerprint Siemens MP370 input panel (Windows CE)
Class Siemens | embedded || specialized
Class Microsoft | Windows | PocketPC/CE | general purpose
CPE cpe:/o:microsoft:windows_ce auto
SEQ(SP=105-10F%GCD=1-6%ISR=107-111%TI=BI%II=BI%SS=S%TS=0)
OPS(O1=M54ENW0NNT00NNS%O2=M54ENW0NNT00NNS%O3=M280NW0NNT00%O4=M22CNW0NNT00NNS%O5=M218NW0NNT00NNS%O6=M109NNT00NNS)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=7C-86%TG=80%W=8000%O=M54ENW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=7C-86%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3F-49%TG=40%W=0%S=A%A=Z%F=R%O=%RD=226D762F%Q=)
T5(R=N)
T6(R=Y%DF=Y%T=3F-49%TG=40%W=0%S=A%A=Z%F=R%O=%RD=226D762F%Q=)
T7(R=N)
U1(DF=N%T=7C-86%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=7C-86%TG=80%CD=Z)

# SIMATIC 300 PLC
Fingerprint Siemens Simatic 300 programmable logic controller
Class Siemens | embedded || specialized
CPE cpe:/h:siemens:simatic_300
SEQ(SP=F9-10D%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M200%O4=M200%O5=M218%O6=M109)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=55-5F%TG=80%W=800%O=M5B4%CC=N)
T1(R=Y%DF=N%T=55-5F%TG=80%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=55-5F%TG=80%W=800%S=O%A=S+%F=AS%O=M109%RD=0)
T4(R=Y%DF=N%T=55-5F%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=73-7D%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=73-7D%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=1B88%RUD=G)
IE(DFI=N%T=73-7D%TG=80%CD=Z)

# Siemens PLC 300 (315 2PN/DP) with ethernet interface and older firmware versions(<3.1).
Fingerprint Siemens Simatic 300 programmable logic controller
Class Siemens | embedded || specialized
CPE cpe:/h:siemens:simatic_300
SEQ(SP=0-5%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=94-9E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Simatic TDC
Fingerprint Siemens Simatic TDC control system
Class Siemens | embedded || specialized
CPE cpe:/h:siemens:simatic_tdc
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%II=I%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=1A-24%TG=20%W=2000%O=M5B4%CC=N)
T1(R=Y%DF=N%T=1A-24%TG=20%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=1A-24%TG=20%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=1A-24%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=1A-24%TG=20%CD=S)

# Siemens SPS system
Fingerprint Siemens SPS programmable logic controller
Class Siemens | embedded || specialized
CPE cpe:/h:siemens:sps
SEQ(SP=FC-10A%GCD=1-6%ISR=105-10F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M200%O4=M200%O5=M218%O6=M109)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=4D-57%TG=80%W=800%O=M5B4%CC=N)
T1(R=Y%DF=N%T=4D-57%TG=80%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=4D-57%TG=80%W=800%S=O%A=S+%F=AS%O=M109%RD=0)
T4(R=Y%DF=N%T=4D-57%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=6B-75%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=6B-75%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=6B-75%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=6B-75%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=5F6E%RUD=G)
IE(DFI=N%T=6B-75%TG=80%CD=Z)

# Central Telephone server HI-PATH4000
Fingerprint Siemens HiPath 4000 VoIP adapter
Class Siemens | embedded || VoIP adapter
CPE cpe:/h:siemens:hipath_4000 auto
SEQ(SP=AE-B8%GCD=1-6%ISR=B4-BE%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=60F4%W2=60F4%W3=60F4%W4=60F4%W5=60F4%W6=60F4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# HiPath optiPoint 400 Standard HFA
Fingerprint Siemens HiPath optiPoint 400 VoIP phone
Class Siemens | embedded || VoIP phone
CPE cpe:/h:siemens:hipath_optipoint_400 auto
SEQ(SP=12-1C%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=41%TG=40%W=2000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=7E-88%TG=80%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=41%TG=40%CD=S)

# optipoint economic 410 (VxWorks evidence: https://www.kb.cert.org/vuls/id/JALR-87RHGP)
Fingerprint Siemens optiPoint 410 VoIP phone (VxWorks)
Class Siemens | embedded || VoIP phone
CPE cpe:/h:siemens:optipoint_410 auto
Class Wind River | VxWorks || VoIP phone
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I|RD%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Siemens Gigaset SE551 WLAN dsl/cable router
Fingerprint Siemens Gigaset SE551 wireless broadband router
Class Siemens | embedded || WAP
CPE cpe:/h:siemens:gigaset_se551 auto
SEQ(SP=0-5%GCD=68|D0|138|1A0|208%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Siemens Gigaset SE551, Firmware Version: v1.608 (Jun 13 2006 11:51:54)
Fingerprint Siemens Gigaset SE551 wireless broadband router
Class Siemens | embedded || WAP
CPE cpe:/h:siemens:gigaset_se551 auto
SEQ(SP=F-1B%GCD=1-6%ISR=4B-55%TI=I|RD%II=I%SS=O%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Siemens Scalance W788-2 Industrial wireless access point
# Siemens Scalance W748-1 - Industrial wireless client Firmware version V01.01.00 - date 03/30/2012 13:25:00 Bootloader version V01.00.00 - date 11/05/2011 17:45:00
Fingerprint Siemens W748 or W788 WAP
Class Siemens | embedded || WAP
CPE cpe:/h:siemens:w748 auto
CPE cpe:/h:siemens:w788 auto
SEQ(SP=0-5%GCD=388|710|A98|E20|11A8%ISR=64-6E%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578NW7%O2=M578NW7%O3=M578NNT11NW7%O4=M578NNT11NW7%O5=M218NNT11NW7%O6=M109NNT11)
WIN(W1=48%W2=48%W3=48%W4=48%W5=48%W6=2400)
ECN(R=Y%DF=N%T=37-41%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SINIX-D (SVR4 derivative made by Fujitsu Siemens, running on i486 hardware)
Fingerprint Siemens SINIX-D on x86
Class Siemens | SINIX || general purpose
CPE cpe:/o:siemens:sinix auto
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1C84%W2=1C84%W3=1C84%W4=1C84%W5=1C84%W6=1C84)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1C84%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SINIX-Z (SVR4 derivative made by Fujitsu Siemens, running on i686 hardware)
Fingerprint Siemens SINIX-Z on RM400
Class Siemens | SINIX || general purpose
CPE cpe:/o:siemens:sinix auto
SEQ(SP=91-9B%GCD=1-6%ISR=9A-A4%TI=RD%II=RI%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=6000%W2=6000%W3=6000%W4=6000%W5=6000%W6=6000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=6000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=6000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# HDHR3-US, Firmware: 20130328
Fingerprint SiliconDust HDHomeRun 3 set top box
Class Silicondust | embedded || media device
CPE cpe:/h:silicondust:hdhr3
SEQ(SP=A0-B6%GCD=1-6%ISR=AD-B7%TI=I%CI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4NW0)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=5B4%S=O%A=S+%F=AS%O=M5B4NW0%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Silicon Dust HDHomerun
# SiliconDust HD Homerun dual-atsc network attached tv tuner
Fingerprint Silicondust HDHomeRun set top box
Class Silicondust | embedded || media device
CPE cpe:/h:silicondust:hdhr
SEQ(SP=A3-B1%GCD=1-6%ISR=A8-B8%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=5B4%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# hdhr-us
Fingerprint SiliconDust HDHomeRun set top box
Class Silicondust | embedded || media device
CPE cpe:/h:silicondust:hdhr
SEQ(SP=FD-107%GCD=1-6%ISR=106-110%TI=I%TS=U)
OPS(O1=M564NW0%O2=M564NW0%O3=M564NW0%O4=M564NW0%O5=M564NW0%O6=M564NNNN)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# HDHomeRun HDTV to ethernet device
Fingerprint SiliconDust HDHomeRun set top box
Class Silicondust | embedded || media device
CPE cpe:/h:silicondust:hdhr
SEQ(SP=A5-AF%GCD=1-6%ISR=B0-BA%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4NW0)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Silicondust HD Homerun with firmware 20150826
# HDHOMERUN PRIME Cable Card Television Tuner
Fingerprint Silicondust HDHomeRun set top box
Class Silicondust | embedded || media device
SEQ(SP=A6-B0%GCD=1-6%ISR=AD-B7%TI=I%CI=I|RI%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4NW0)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=S+%F=AS%O=M5B4NW0%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Sipura SPA-1001 VoIP adapter; Software Version 2.0.10(e); Hardware Version 2.0.1(9799)
# Sipura SPA-3000 VoIP adapter
Fingerprint Sipura SPA1001 or SPA3000 VoIP adapter
Class Sipura | embedded || VoIP adapter
CPE cpe:/h:sipura:spa1001_voice_gateway_with_router:-
CPE cpe:/o:sipura:spa1001_voice_gateway_with_router_firmware
CPE cpe:/h:sipura:spa3000_voice_gateway_with_router:-
CPE cpe:/o:sipura:spa3000_voice_gateway_with_router_firmware
SEQ(SP=E7-107%GCD=1-6%ISR=103-111%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=F5-FF%TG=FF%W=3E80%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=F5-FF%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
T3(R=Y%DF=N%T=F5-FF%TG=FF%W=3E80%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T5(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S+%F=ARF%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T7(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
U1(DF=N%T=F5-FF%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F5-FF%TG=FF%CD=S)

# LinkSys/Sipura SPA3000, software version 3.1.10(GWd), hardware version 2.0.1(1448).
Fingerprint Sipura SPA3000 VoIP adapter
Class Sipura | embedded || VoIP adapter
CPE cpe:/h:sipura:spa3000_voice_gateway_with_router:-
CPE cpe:/o:sipura:spa3000_voice_gateway_with_router_firmware
SEQ(SP=103-10D%GCD=1-6%ISR=101-111%TI=RD%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=FA%TG=FF%W=3E80%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA%TG=FF%W=0%S=Z%A=O|S+%F=ARF%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA%TG=FF%CD=S)

# SPA-3000
Fingerprint Sipura SPA3000 VoIP adapter
Class Sipura | embedded || VoIP adapter
CPE cpe:/h:sipura:spa3000 auto
SEQ(SP=FD-107%GCD=1-6%ISR=FF-109%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=F5-FF%TG=FF%W=3E80%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=F5-FF%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
T3(R=Y%DF=N%T=F5-FF%TG=FF%W=3E80%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S+%F=ARF%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=F5-FF%TG=FF%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
U1(DF=N%T=F5-FF%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F5-FF%TG=FF%CD=S)

# 1.4
Fingerprint Sitecom Wireless Network Broadband Router
Class Sitecom | embedded || WAP
SEQ(SP=C9-D3%GCD=1-6%ISR=CD-D7%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5B4%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5B4%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sitecom ADSL2+ Modem/Router 54G Turbo WL-174
# ZyXEL AIR B-3000
Fingerprint Sitecom WL-174 wireless ADSL router or ZyXEL B-3000 WAP
Class Sitecom | embedded || WAP
CPE cpe:/h:sitecom:wl-174 auto
Class ZyXEL | embedded || WAP
CPE cpe:/h:zyxel:b-3000 auto
SEQ(R=N)
OPS(O1=M200%O2=%O3=%O4=%O5=%O6=)
WIN(W1=400%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0%O=%CC=Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# Sitecom 300N Wireless Router, according to the box. Sitecom wireless broadband router WL-342, according to the web config page.
Fingerprint Sitecom WL-342 WAP
Class Sitecom | embedded || WAP
CPE cpe:/h:sitecom:wl-342 auto
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1770%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=Z)

# Slingbox model 350
Fingerprint Slingbox 350 media server
Class Sling | embedded || media device
SEQ(SP=C8-D2%GCD=1-6%ISR=CC-D6%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M550ST11NW5%O2=M550ST11NW5%O3=M550NNT11NW5%O4=M550ST11NW5%O5=M550ST11NW5%O6=M550ST11)
WIN(W1=1510%W2=1510%W3=1510%W4=1510%W5=1510%W6=1510)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1540%O=M550NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1510%S=O%A=S+%F=AS%O=M550ST11NW5%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Slingbox Classic
Fingerprint Slingbox Classic TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_classic
SEQ(SP=0-5%GCD=1F400|3E800|5DC00|7D000|9C400%ISR=9D-A7%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=%O6=)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Slingbox Classic Firmware 1.0.89
Fingerprint Slingbox Classic TV over IP gateway (Firmware 1.0.89)
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_classic
SEQ(SP=0%GCD=1F400|3E800|5DC00|7D000|9C400|BB800%ISR=9D-A7%TI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Slingbox PRO
Fingerprint Slingbox PRO TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_pro
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9D-A7%TI=I%CI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4SNN%O2=M578SNN%O3=M280%O4=M5B4SNN%O5=M218SNN%O6=M109SNN)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4SNN%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# This is a SlingBrox Pro
Fingerprint Slingbox Pro TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_pro
SEQ(SP=0-5%GCD=1F400|3E800|5DC00|7D000|9C400%ISR=9D-A7%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=%O6=)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# http://support.slingbox.com/docs/IO/28560/PROHD_QSG.pdf
Fingerprint Slingbox Pro-HD TV over IP gateway
Class Sling | embedded || media device
SEQ(SP=101-10B%GCD=1-6%ISR=108-112%TI=I|RD%CI=I%II=I%SS=O%TS=U)
OPS(O1=M5B0%O2=M5B0%O3=M5B0%O4=M5B0%O5=M5B0%O6=M5B0)
WIN(W1=7D00%W2=7D00%W3=7D00%W4=7D00%W5=7D00%W6=7D00)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=7D00%O=M5B0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Slingbox Solo UK
# Slingbox Pro
Fingerprint Slingbox SOLO or PRO TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_solo
CPE cpe:/h:slingmedia:slingbox_pro
SEQ(SP=0-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9D-A7%TI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4SNN%O2=M578SNN%O3=M280%O4=M5B4SNN%O5=M218SNN%O6=M109SNN)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4SNN%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# slingbox solo
Fingerprint Slingbox SOLO TV over IP gateway
Class Sling | embedded || media device
SEQ(SP=0-5%GCD=1F400|3E800|5DC00|7D000|9C400%ISR=9D-A7%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Slingbox Tuner - Latest firmware (as of 10/25/2008).
Fingerprint Slingbox Tuner TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_tuner
SEQ(SP=0-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9E-A8%TI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4SNN%O2=M578SNN%O3=M280%O4=M5B4SNN%O5=M218SNN%O6=M109SNN)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4SNN%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Slingbox Hardware Rev 1.107.2 Firmware 1.3.80
# Slingbox Tuner - Firmware 1.2.9
# Slingbox Solo
# Mango DSP, Board Info Raven-M 720Mhz, Application 2.0.2.12 built Sep 16 2009, 14:20:08
Fingerprint Slingbox TV over IP gateway (Firmware 1.2.9 - 1.3.80)
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox
SEQ(SP=0-5%GCD=1F400|3E800|5DC00|7D000|9C400%ISR=9D-A7%TI=I%CI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Slingmedia Slingbox AV Hardware 1.2.0 Firmware 1.0.1
Fingerprint Slingmedia Slingbox AV TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_av
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=9E-A8%TI=I%II=RI%SS=O%TS=U)
OPS(O1=|M5AC%O2=|M578%O3=|M280%O4=|M5AC%O5=%O6=)
WIN(W1=0|2000%W2=0|2000%W3=0|2000%W4=0|2000%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=O|S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Original (1st edition) Slingbox
Fingerprint Slingmedia Slingbox AV TV over IP gateway
Class Sling | embedded || media device
CPE cpe:/h:slingmedia:slingbox_av
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9E-A8%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Smart Mirage CX06 Satellite Receiver
Fingerprint Smart Mirage CX06 satellite receiver
Class Smart Electronic | embedded || media device
SEQ(SP=F-39%GCD=1-6%ISR=58-62%TI=RD%CI=I%II=RI%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Smartlink DIGISOL DG-HR3400
Fingerprint Smartlink DIGISOL DG-HR3400 WAP
Class Smartlink | embedded || WAP
CPE cpe:/h:smartlink:digisol_dg-hr3400 auto
SEQ(SP=98-A2%GCD=1-6%ISR=98-A2%TI=I%CI=I%II=RI%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=2000%S=O%A=S+%F=AS%O=M5B4NW0NNT11NNLLLLLLLLLL%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# SMC7004ABR
Fingerprint SMC SMB7004ABR WAP
Class SMC | embedded || broadband router
CPE cpe:/h:smc:smb7004abr auto
SEQ(SP=0-5%GCD=B|16|21|2C|37%ISR=30-3A%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1770%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|O|Y%T=3B-45%TG=40%CD=Z)

# SMC8014WG, Hardware Version 1B, Firmware Version 4.01.21-CCR
# SMC SMC8014WG cable modem
Fingerprint SMC SMC8014WG WAP
Class SMC | embedded || broadband router
CPE cpe:/h:smc:smc8014wg auto
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# smc8014wgccr
Fingerprint SMC SMC8014WG WAP
Class SMC | embedded || broadband router
CPE cpe:/h:smc:smc8014wg auto
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SMC Barricade Broadband Router (7004BR) with firmware R1.96h2
Fingerprint SMC Barricade 7004BR router
Class SMC | embedded || router
CPE cpe:/h:smc:barricade_7004br auto
SEQ(SP=0-1D%GCD=32|64|96|C8|FA%ISR=4B-55%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SMC7908A-ISP
Fingerprint SMC SMC7908A-ISP router
Class SMC | embedded || router
CPE cpe:/h:smc:smc7908a-isp auto
SEQ(SP=22-30%GCD=1-6%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# SMC Networks 8024L2 switch
Fingerprint SMC 8024L2 switch
Class SMC | embedded || switch
CPE cpe:/h:smc:8024l2 auto
SEQ(SP=E-18%GCD=A|14|1E|28|32%ISR=1F-2F%TI=I%II=RI%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=600%W2=600%W3=600%W4=600%W5=600%W6=600)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=600%O=M5B4%CC=N%Q=U)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=80%S=A%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=100%S=A%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=400%S=A%A=S+%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7A69%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=8000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SMC SMC7724M/VSW, Loader version: 0.0.6.4, Boot rom version: 0.0.6.6, Operation code version: 1.8.2.18
# SMC TigerSwitch 10/100 - SMC6750L2
Fingerprint SMC SMC6750L2 or SMC7724M/VSW switch
Class SMC | embedded || switch
CPE cpe:/h:smc:smc6750l2
CPE cpe:/h:smc:smc7724m%2fvsw
SEQ(SP=8C-96%GCD=1-6%ISR=91-9B%TI=I%II=RI%SS=O%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M5B4NW0NNT11NNLLLLLLLLLL%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SMC TigerStack III 10/100 - 6824M Managed 24+2 Stackable Switch
Fingerprint SMC TigerStack III 6824M switch
Class SMC | embedded || switch
CPE cpe:/h:smc:tigerstack_iii_6824m auto
SEQ(SP=8C-96%GCD=1-6%ISR=92-9C%TI=I%CI=I%II=RI%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M5B4NW0NNT11NNLLLLLLLLLL%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SMC TigerSwitch SMC8150L2
Fingerprint SMC TigerSwitch SMC8150L2 switch
Class SMC | embedded || switch
CPE cpe:/h:smc:tigerswitch_smc8150l2 auto
SEQ(SP=8E-98%GCD=1-6%ISR=93-9D%TI=I%II=RI%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SMC 7904WBRA Wireless ADSL2+ Router
Fingerprint SMC 7904WBRA-N wireless ADSL router
Class SMC | embedded || WAP
CPE cpe:/h:smc:7904wbra-n auto
SEQ(SP=16-30%GCD=1-6%ISR=4B-55%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|S%T=41%TG=40%CD=Z)

# SMC broadband router / WAP - model SMC2804WBRP-G ; Runtime Code Version: v2.08
Fingerprint SMC SMC2804WBRP-G wireless broadband router
Class SMC | embedded || WAP
CPE cpe:/h:smc:smc2804wbrp-g auto
SEQ(SP=0%GCD=1-6|A|14|1E|28|32|3C%ISR=30-3A%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1770%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1770%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|O|Y%T=3B-45%TG=40%CD=Z)

# Speedport W 700V, firmware version 1.22.000
# SMC, device model: SMC7904WBRA
Fingerprint SMC SMC7904WBRA wireless ADSL router or T-Home Speedport W 700V WAP
Class SMC | embedded || WAP
CPE cpe:/h:smc:smc7904wbra
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_700v
SEQ(SP=0-1C%GCD=1-6|64|C8|12C|190|1F4%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# SMC7904WBRB2 Firmware v0.08b
Fingerprint SMC SMC7904WBRB2 wireless broadband router
Class SMC | embedded || WAP
CPE cpe:/h:smc:smc7904wbrb2 auto
SEQ(SP=0-5%GCD=68|D0|138|1A0|208|270%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1770%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1770%S=O%A=O|S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|S%T=3B-45%TG=40%CD=Z)

# SMC Barricade broadband router.The product code is SMCWBR14-G2.
Fingerprint SMC SMCWBR14-G2 Barricade g WAP
Class SMC | embedded || WAP
CPE cpe:/h:smc:smbwbr14-g2
SEQ(SP=0-5%GCD=A|14|1E|28|32%ISR=30-3A%TI=I%CI=I%II=I%SS=O%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=41%TG=40%W=1770%O=M578%CC=N)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=41%TG=40%W=1770%S=O%A=S+%F=AS%O=M109%RD=0)
T4(R=Y%DF=N%T=41%TG=40%W=0%S=A%A=O%F=R%RD=0)
T5(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=41%TG=40%W=0%S=A%A=O%F=R%RD=0)
T7(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=Y%T=41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=41%TG=40%CD=Z)

# SMCWBR14-G2 EU Barricade g Wireless Broadband Router
Fingerprint SMC SMCWBR14-G2 EU Barricade g WAP
Class SMC | embedded || WAP
CPE cpe:/h:smc:smbwbr14-g2
SEQ(SP=0-1A%GCD=1-6|B|16|21|2C|37%ISR=30-3A%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=1770%W2=1770%W3=1770%W4=1770%W5=1770%W6=1770)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1770%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1770%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|S%T=3B-45%TG=40%CD=Z)

# Snom360 VoIP phone
Fingerprint Snom 360 VoIP phone
Class Snom | embedded || VoIP phone
CPE cpe:/h:snom:360 auto
SEQ(SP=C1-CB%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M558ST11NW0%O2=M558ST11NW0%O3=M558NNT11NW0%O4=M558ST11NW0%O5=M558ST11NW0%O6=M558ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M558NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M558ST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SNOM 715 VOIP Phone.
Fingerprint SNOM 715 VoIP phone
Class Snom | embedded || VoIP phone
CPE cpe:/h:snom:715 auto
SEQ(SP=BD-C7%GCD=1-6%ISR=C7-D1%TI=I%CI=Z%II=I%SS=S%TS=7)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SNR-S2960-24G Device SoftWare Version 6.2.139.118
Fingerprint SNR SNR-S2960 switch
Class SNR | embedded || switch
CPE cpe:/h:snr:snr-s2960 auto
SEQ(SP=B5-BF%GCD=1-6%ISR=C6-D0%TI=Z%CI=I%II=I%TS=6)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Aventail EX-1500 SSL VPN Appliance, Version: 8.6.1-192
Fingerprint SonicWALL Aventail EX-1500 SSL VPN appliance
Class SonicWALL | embedded || firewall
CPE cpe:/o:sonicwall:aventail_ex-1500
SEQ(SP=C2-CC%GCD=1-6%ISR=CA-D4%TI=Z%II=I%TS=A)
OPS(O1=M564ST11NW2%O2=M564ST11NW2%O3=M564NNT11NW2%O4=M564ST11NW2%O5=M564ST11NW2%O6=M564ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M564NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=1F-3D%TG=20|40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1D-30%TG=20|40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sonicwall TZ 170 Unlimited (Firmware unknown)
Fingerprint SonicWALL TZ 170 Unlimited firewall (SonicOS)
Class SonicWALL | embedded || firewall
CPE cpe:/o:sonicwall:tz_170
SEQ(SP=90-9E%GCD=1-6%ISR=96-A2%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Aventail EX-6000 v9.0 Firmware
Fingerprint SonicWALL Aventail EX-6000 VPN appliance
Class SonicWALL | embedded || proxy server
CPE cpe:/o:sonicwall:aventail_ex-6000
SEQ(SP=C6-D0%GCD=1-6%ISR=CE-D8%TI=Z%CI=Z%TS=8)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Sonicwall TZ 170 Standard - Firmware: SonicOS Standard 2.0.0.2 - ROM Version: SonicROM 2.0.0.3
Fingerprint SonicWALL TZ 170 Standard firewall (SonicOS 2.0)
Class SonicWALL | SonicOS | 2.X | firewall
CPE cpe:/o:sonicwall:sonicos:2.0 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicWALL PRO 2040 (SonicOS Standard 3.1)
Fingerprint SonicWALL PRO 2040 firewall (SonicOS 3.1)
Class SonicWALL | SonicOS | 3.X | firewall
CPE cpe:/o:sonicwall:sonicos:3.1 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicWall Pro 4060 running SonicOS Enhanced 3.2.0.3-54e
Fingerprint SonicWALL PRO 4060 firewall (SonicOS 3.2)
Class SonicWALL | SonicOS | 3.X | firewall
CPE cpe:/o:sonicwall:sonicos:3.2 auto
SEQ(SP=FF-109%GCD=1-6%ISR=109-113%II=I%TS=U)
OPS(O1=M5B4NW0%O2=M578NW0%O3=M280NW0%O4=M22CNW0%O5=M218NW0%O6=M109)
WIN(W1=5B4%W2=578%W3=280%W4=22C%W5=218%W6=109)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicOS Standard 3.9.1.5-53s
Fingerprint SonicWALL SonicOS 3.9
Class SonicWALL | SonicOS | 3.X | firewall
CPE cpe:/o:sonicwall:sonicos:3.9 auto
SEQ(SP=100-10A%GCD=1-6%ISR=107-111%TI=I|RD%CI=RI%II=I%SS=S%TS=1)
OPS(O1=|M1B0NW0NNT11%O2=|M1B0NW0NNT11%O3=|M1B0NW0NNT11%O4=|M1B0NW0NNT11%O5=|M1B0NW0NNT11%O6=|M109NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N|Y%T=3B-45%TG=40%W=4000%O=|M1B0NW0%CC=N%Q=)
T1(R=Y%DF=N|Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=E3E07B45%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=E3E07B45%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# TZ 170 Standard, Firmware Version: SonicOS Standard 3.1.6.3-4s
Fingerprint SonicWALL TZ 170 Standard firewall (SonicOS 3.1)
Class SonicWALL | SonicOS | 3.X | firewall
CPE cpe:/o:sonicwall:sonicos:3.1 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicWALL TZ 170 Standard (VPN Router) running firmware SonicOS Standard 3.1.0.11-85s  with ROM SonicROM 3.0.0.6
Fingerprint SonicWALL TZ 170 Standard firewall (SonicOS 3.1)
Class SonicWALL | SonicOS | 3.X | firewall
CPE cpe:/o:sonicwall:sonicos:3.1 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=99-A3%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicOS Enhanced 4.0.0.12-64e on PRO 3060 Enhanced
Fingerprint SonicWALL PRO 3060 Enhanced firewall (SonicOS 4.0.0.12)
Class SonicWALL | SonicOS | 4.X | firewall
CPE cpe:/o:sonicwall:sonicos:4.0.0.12 auto
SEQ(SP=FF-109%GCD=1-6%ISR=106-110%TI=I%CI=RI%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M578NW0%O3=M280NW0%O4=M22CNW0%O5=M218NW0%O6=M109)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicOS Enhanced 4.0.1.1-41e, SonicWALL TZ190, but I believe the OS is hardware non-specific.
Fingerprint SonicWALL TZ 190 firewall (SonicOS Enhanced 4.0)
Class SonicWALL | SonicOS | 4.X | firewall
CPE cpe:/o:sonicwall:sonicos:4 auto
SEQ(SP=F9-103%GCD=1-6%ISR=104-10E%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M578NW0NNT11%O3=M280NW0NNT11%O4=M22CNW0NNT11%O5=M218NW0NNT11%O6=M109NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# NSA 220 SonicOS Enhanced 5.9.0.6-3o
Fingerprint Dell Sonicwall NSA 220 firewall
Class SonicWALL | SonicOS | 5.X | firewall
CPE cpe:/o:sonicwall:sonicos:5 auto
SEQ(SP=F9-103%GCD=1-6%ISR=FC-110%TI=I%CI=Z%II=I%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM578SNW0%O3=M280NW0%O4=NNM22CSNW0%O5=NNM218SNW0%O6=NNM109S)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=E3E07B45%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=28D49A85%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=E3E07B45%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# NSA 220 SonicOS Enhanced 5.8.1.4-31o
Fingerprint SonicWALL NSA 220 firewall (SonicOS Enhanced 5.8)
Class SonicWALL | SonicOS | 5.X | firewall
CPE cpe:/o:sonicwall:sonicos:5 auto
SEQ(SP=FF-109%GCD=1-6%ISR=109-113%TI=I%CI=RI%II=I%SS=O%TS=6)
OPS(O1=|M5B4NW0NNT11%O2=|M578NW0NNT11%O3=|M280NW0NNT11%O4=|M22CNW0NNT11%O5=|M218NW0NNT11%O6=|M109NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=|M5B4NW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SonicOS Enhanced 5.2.0.1-21o
Fingerprint SonicWALL SonicOS Enhanced 5.2
Class SonicWALL | SonicOS | 5.X | firewall
CPE cpe:/o:sonicwall:sonicos:5 auto
SEQ(SP=101-10B%GCD=1-6%ISR=106-110%TI=I%CI=RI%II=I%SS=S%TS=6)
OPS(O1=M5B4NW0NNT11%O2=M578NW0NNT11%O3=M280NW0NNT11%O4=M22CNW0NNT11%O5=M218NW0NNT11%O6=M109NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Model: TELE3 SP (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.3.0-3s
Fingerprint SonicWALL TELE3 firewall (SonicOS 6.6.3.0)
Class SonicWALL | SonicOS | 6.X | firewall
CPE cpe:/o:sonicwall:sonicos:6.6.3.0 auto
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=I%CI=Z%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=1B-25|3B-45%TG=20|40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=1B-25%TG=20%W=80%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T3(R=N)
T4(R=Y%DF=N%T=1B-25%TG=20%W=400%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=75444779%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=8000%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=44BD347E%Q=)
U1(R=N)
IE(R=N)

# sonicwall pro 230
Fingerprint SonicWALL PRO 230 firewall (SonicOS)
Class SonicWALL | SonicOS || firewall
CPE cpe:/o:sonicwall:sonicos auto
SEQ(SP=85-9F%GCD=1-6%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Sonos ZonePlayer version 2.6 (build 9166130) m16: 1.0-12170 r8: 0.8-16
Fingerprint Sonos ZonePlayer audio distribution unit
Class Sonos | embedded || media device
CPE cpe:/h:sonos:zoneplayer
SEQ(SP=C7-D1%GCD=1-6%ISR=CD-D7%TI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=41%TG=40%W=16D0%O=M5B4NNSNW7%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=41%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=41%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=41%TG=40%CD=S)

# Sonus GSX 9000 HD SIP Server. A carrier-level SIP proxy.
Fingerprint Sonus GSX9000 VoIP proxy
Class Sonus | embedded || VoIP adapter
CPE cpe:/h:sonus:gsx9000 auto
SEQ(SP=B2-BC%GCD=1-6%ISR=C7-D1%CI=I%TS=U)
OPS(O1=M5AC%O2=M5AC%O3=M5AC%O4=M5AC%O5=M5AC%O6=M5AC)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5AC%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(R=N)
IE(R=N)

# Sonus SBC1000 sip gateway ver 6.1.1
Fingerprint Sonus SBC1000 SIP gateway
Class Sonus | embedded || VoIP adapter
CPE cpe:/h:sonus:sbc1000
SEQ(SP=FD-107%GCD=1-6%ISR=102-10C%TI=RD%CI=RD%TS=U)
OPS(O1=M55CNNSNW7%O2=M55CNNSNW7%O3=M55CNW7%O4=M55CNNSNW7%O5=M55CNNSNW7%O6=M55CNNS)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3A-44%TG=40%W=4000%O=M55CNNSNW7%CC=N%Q=)
T1(R=Y%DF=N%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=4000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=0%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson AINO  mobile phone on wlan network
Fingerprint Sony Ericsson Aino mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:aino
SEQ(SP=F1-FB%GCD=1-6%ISR=104-10E%TI=I%CI=RD%II=I%SS=S%TS=9)
OPS(O1=M5ACSW0NT11%O2=M5ACSW0NT11%O3=M5ACSW0NT11%O4=M5ACSW0NT11%O5=M5ACSW0NT11%O6=M5ACST11)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=8000%O=M5ACSW0LLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson W910i mobile phone
# Sony Ericsson C902, Software version: R3BA035
# Sony Ericsson Z780i GSM/UMTS phone
Fingerprint Sony Ericsson C902, W910i, or Z780i mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:c902
CPE cpe:/h:sonyericsson:w910i
CPE cpe:/h:sonyericsson:z780i
SEQ(SP=F3-10F%GCD=1-6%ISR=104-112%TI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4SW0NT11%O2=M5B4SW0NT11%O3=M5B4SW0NT11%O4=M5B4SW0NT11%O5=M5B4SW0NT11%O6=M5B4ST11)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%O=M5B4SW0LLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson G900. I believe it is running Symbian OS.
Fingerprint Sony Ericsson G900 mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:g900
SEQ(SP=A7-B5%GCD=1-6%ISR=AE-B8%TI=I%II=I%SS=S%TS=14)
OPS(O1=M5ACT11W0SL%O2=M5ACT11W0SL%O3=M5ACT11W0LLL%O4=M5ACT11W0SL%O5=M5ACT11W0SL%O6=M5ACT11S)
WIN(W1=BB2C%W2=BB2C%W3=BB2C%W4=BB2C%W5=BB2C%W6=BB2C)
ECN(R=Y%DF=Y%T=45%TG=80%W=BB2C%O=M5ACW0SLLL%CC=N%Q=)
T1(R=Y%DF=N|Y%T=45%TG=80%S=Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=45%TG=80%W=BB2C%S=O%A=S+%F=AS%O=M5ACT11W0SL%RD=0%Q=)
T4(R=Y%DF=N%T=45%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=45%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=45%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=45%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=45%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=45%TG=80%CD=S)

# Sony Ericsson Hazel (J20i)
# Sony Ericsson Hazel (j20)
Fingerprint Sony Ericsson Hazel (J10, J20) or Elm mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:j20
CPE cpe:/h:sonyericsson:j20i
SEQ(SP=FE-10A%GCD=1-6%ISR=107-111%TI=I%CI=RD|RI%II=I%SS=S%TS=9|A)
OPS(O1=M5ACSW1NT11%O2=M5ACSW1NT11%O3=M5ACSW1NT11%O4=M5ACSW1NT11%O5=M5ACSW1NT11%O6=M5ACST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M5ACSW1LLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson K850i, Version 1200-4398 R1CA037 071012 SonyEricsson
Fingerprint Sony Ericsson K850i mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:k850i
SEQ(SP=102-10C%GCD=1-6%ISR=106-110%TI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4SW0NT11%O2=M5B4SW0NT11%O3=M5B4SW0NT11%O4=M5B4SW0NT11%O5=M5B4SW0NT11%O6=M5B4ST11)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=FAF0%O=M5B4SW0LLL%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Sony Ericsson U8i Vivaz Pro Cellphone
Fingerprint Sony Ericsson U8i Vivaz mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:u8i_vivaz
SEQ(CI=I%II=I)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=N)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Sony Ericsson W715 Luxury Silver programversion: 1217-2243-R1DA029 090126
# Sony Ericsson W705
Fingerprint Sony Ericsson W705 or W715 Walkman mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:w705
CPE cpe:/h:sonyericsson:w715
SEQ(CI=RD%II=I)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=N)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson W995
# Sony Ericsson W705 Walkman mobile phone
Fingerprint Sony Ericsson W705 or W995 Walkman mobile phone
Class Sony Ericsson | embedded || phone
CPE cpe:/h:sonyericsson:w705
SEQ(SP=101-10B%GCD=1-6%ISR=101-113%TI=I%CI=RD%II=I%SS=S%TS=A)
OPS(O1=M5ACSW0NT11%O2=M5ACSW0NT11%O3=M5ACSW0NT11%O4=M5ACSW0NT11%O5=M5ACSW0NT11%O6=M5ACST11)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%O=M5ACSW0LLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Ericsson M600i Symbian OS 9.1 UIQ 3.0 firmware R9A002
Fingerprint Sony Ericsson M600i mobile phone (Symbian OS 9.1)
Class Sony Ericsson | Symbian OS | 9.X | phone
CPE cpe:/h:sonyericsson:m600i
CPE cpe:/o:sonyericsson:symbian_os:9.1 auto
SEQ(SP=A6-B0%GCD=1-6%ISR=AB-B5%TI=I%II=I%SS=S%TS=14)
OPS(O1=|M5ACT11W0SL%O2=|M5ACT11W0SL%O3=|M5ACT11W0LLL%O4=|M5ACT11W0SL%O5=|M5ACT11W0SL%O6=|M5ACT11S)
WIN(W1=0|BB2C%W2=0|BB2C%W3=0|BB2C%W4=0|BB2C%W5=0|BB2C%W6=0|BB2C)
ECN(R=Y%DF=Y%T=40-4A%TG=80%W=BB2C%O=M5ACW0SLLL%CC=N%Q=)
T1(R=Y%DF=N|Y%T=40-4A%TG=80%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=40-4A%TG=80%W=BB2C%S=O%A=S+%F=AS%O=M5ACT11W0SL%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Sony Ericsson P1i handheld. OS is Symbian OS v9.1 UIQ3
Fingerprint Sony Ericsson P1i mobile phone (Symbian OS 9.1)
Class Sony Ericsson | Symbian OS | 9.X | phone
CPE cpe:/h:sonyericsson:p1i
CPE cpe:/o:sonyericsson:symbian_os:9.1 auto
SEQ(SP=A1-B1%GCD=1-6%ISR=A8-B2%TI=I%II=I%SS=S%TS=14)
OPS(O1=|M5ACT11W0SL%O2=|M5ACT11W0SL%O3=|M5ACT11W0LLL%O4=|M5ACT11W0SL%O5=|M5ACT11W0SL%O6=|M5ACT11S)
WIN(W1=0|BB2C%W2=0|BB2C%W3=0|BB2C%W4=0|BB2C%W5=0|BB2C%W6=0|BB2C)
ECN(R=Y%DF=N|Y%T=40-4A%TG=80%W=0|BB2C%O=|M5ACW0SLLL%CC=N%Q=)
T1(R=Y%DF=N|Y%T=40-4A%TG=80%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N|Y%T=40-4A%TG=80%W=0|BB2C%S=O|Z%A=O|S+%F=A|AR|AS%O=|M5ACT11W0SL%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Sony PlayStation 2 game console
Fingerprint Sony PlayStation 2 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_2
SEQ(SP=12-40%GCD=1-6%ISR=5F-8B%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=20-3A%TG=40%CD=S)

# this is the ps2 linux kit cony released, 2.2.1(ps2-linux)
Fingerprint Sony PlayStation 2 game console test kit 2.2.1
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_2
SEQ(SP=BA-C4%GCD=1-6%ISR=CA-D4%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4ST10NW0%O2=M578ST10NW0%O3=M280NNT10NW0%O4=M218ST10NW0%O5=M218ST10NW0%O6=M109ST10)
WIN(W1=7D78%W2=7DC8%W3=7F80%W4=7FB8%W5=7FB8%W6=7F53)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=7D78%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=7F53%S=O%A=S+%F=AS%O=M109ST10NW0%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Sony PlayStation 3
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(SP=F7-101%GCD=1-6%ISR=FC-106%TI=RD%TS=21)
OPS(O1=M5B4NNSNW1NNT11%O2=M5B4NNSNW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NNSNW1NNT11%O5=M5B4NNSNW1NNT11%O6=M5B4NNSNNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=41%TG=40%W=FFFF%O=M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=N%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=41%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=41%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NNSNW1NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=41%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Jailbroken PS3 With firmware 3.31
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(CI=RD%II=RI)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=N)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Playstation 3 version 3.55
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(SP=D4-DE%GCD=1-6%ISR=DA-E4%TI=RD%CI=RD|RI%II=RI%TS=0)
OPS(O1=M5B4NW0NNT01SNN%O2=M5B4NW0NNT01SNN%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01SNN%O5=M5B4NW0NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW0SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW0NNT01SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# PS3
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(SP=D3-DF%GCD=1-6%ISR=DA-E4%TI=RD%CI=RD%II=RI%TS=0)
OPS(O1=M5B4NW0NNT01SNN%O2=M5B4NW0NNT01SNN%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01SNN%O5=M5B4NW0NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT01SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Sony PlayStation 3
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(II=RI)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Playstation 3, version 4.80
Fingerprint Sony PlayStation 3 game console
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(SP=D5-DF%GCD=1-6%ISR=D9-E3%TI=RD%CI=RD%II=RI%TS=0)
OPS(O1=M5B4NW1NNT01SNN%O2=M5B4NW1NNT01SNN%O3=M5B4NW1NNT01%O4=M5B4NW1NNT01SNN%O5=M5B4NW1NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT01SNN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Sony PS3 Test Kit
Fingerprint Sony PlayStation 3 game console test kit
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_3
SEQ(SP=D2-DC%GCD=1-6%ISR=DA-E4%TI=RD%II=RI%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=O|S+%F=AS%O=M5B4NW0NNT01|M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Modified Sony PSP running 3.90M33-2 custom firmware
# Playstation Portable (PSP), running a FTP server.
# Sony PSP, 5.50 GEN-D (Full), hacked version of the m33 (Dark-Alex) firmware, running PSP FTPd
Fingerprint Sony PSP game console (modified, running Custom Firmware 3.90 - 5.50)
Class Sony | embedded || game console
CPE cpe:/h:sony:playstation_portable
SEQ(SP=C9-D9%GCD=1-6%ISR=D8-E2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Sony Blu-ray Player S370
# BluRay Player, Sony BDP-370. Calls itself "FedoraCore/2" Server in UPnP Multicast Messages... (doubt it)
# Sony BDP-S570
Fingerprint Sony BDP-S370 or BDP-S570 Blu-ray player
Class Sony | embedded || media device
CPE cpe:/h:sony:bdp-s370
CPE cpe:/h:sony:bdp-s570
SEQ(SP=84-9E%GCD=1-6%ISR=94-9E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0NNS%O2=M578NW0NNS%O3=M280NW0%O4=M218NW0NNS%O5=M218NW0NNS%O6=M109NNS)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%S=O%A=S+%F=AS%O=M109NW0NNS%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# home cinema from sony model BDV-e970W
Fingerprint Sony BDV-E970W television
Class Sony | embedded || media device
CPE cpe:/h:sony:bdv-e970w
SEQ(SP=89-93%GCD=1-6%ISR=92-9C%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0NNS%O2=M578NW0NNS%O3=M280NW0%O4=M218NW0NNS%O5=M218NW0NNS%O6=M109NNS)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Sony Home Theater System BDV-T57
Fingerprint Sony BDV-T57 television
Class Sony | embedded || media device
CPE cpe:/h:sony:bdv-t57
SEQ(SP=87-9D%GCD=1-6%ISR=9A-A4%TI=I%TS=U)
OPS(O1=M5B4NW0NNS%O2=M578NW0NNS%O3=M280NW0%O4=M218NW0NNS%O5=M218NW0NNS%O6=M109NNS)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Sony Blu-Ray Player
Fingerprint Sony Blu-Ray Player
Class Sony | embedded || media device
SEQ(SP=C8-D2%GCD=1-6%ISR=CB-D5%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=10F8%W2=10F8%W3=10F8%W4=10F8%W5=10F8%W6=10F8)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=111C%O=M5B4NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony KDL-46hx720 TV (European model).
Fingerprint Sony Bravia HX720-series TV
Class Sony | embedded || media device
SEQ(SP=C5-CF%GCD=1-6%ISR=C8-D2%TI=Z%II=I%TS=7|8|A)
OPS(O1=NNT11|M5B4ST11%O2=NNT11|M5B4ST11%O3=NNT11|M5B4NNT11%O4=NNT11|M5B4ST11%O5=NNT11|M5B4ST11%O6=NNT11|M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=|M5B4NNS%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=O|S+%F=A|AS%O=NNT11|M5B4ST11%RD=0)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Bravia smart TV, Android
Fingerprint Sony Bravia smart TV (Android)
Class Sony | embedded || media device
Class Google | Android || media device
CPE cpe:/o:google:android auto
SEQ(SP=FC-106%GCD=1-6%ISR=109-113%TI=Z%CI=I|RD%II=I%TS=7-9)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=A9B0%W2=A9B0%W3=A9B0%W4=A9B0%W5=A9B0%W6=A9B0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=A564%O=M5B4NNSNW6%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Bravia KDL-32V5500 TV
Fingerprint Sony Bravia V5500-series TV
Class Sony | embedded || media device
CPE cpe:/h:sony:bravia_kdl-32v5500
SEQ(SP=C8-D2%GCD=1-6%ISR=D5-DF%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=Y%T=6A-74%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6A-74%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=856D%RUD=G)
IE(DFI=N%T=6A-74%TG=80%CD=Z)

# SONY BRAVIA KDL-37V5500 with firmware 1.741EA for Ukraine
Fingerprint Sony Bravia V5500-series TV
Class Sony | embedded || media device
SEQ(SP=C2-D4%GCD=1-6%ISR=D5-DF%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W3L%O2=M5B4W3L%O3=M5B4W3L%O4=M5B4W3L%O5=M5B4W3L%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=6A-74%TG=80%W=FFFF%O=M5B4W3L%CC=N%Q=)
T1(R=Y%DF=Y%T=6A-74%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6A-74%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6A-74%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6A-74%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=83CC%RUD=G)
IE(DFI=N%T=6A-74%TG=80%CD=Z)

# BRAVIA KDL-46W4500/47
Fingerprint Sony Bravia W4500-series TV
Class Sony | embedded || media device
SEQ(SP=CE-D8%GCD=1-6%ISR=D6-E0%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=6E-78%TG=80%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=6E-78%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=6E-78%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6E-78%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6E-78%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6E-78%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6E-78%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=854A%RUD=G)
IE(DFI=N%T=6E-78%TG=80%CD=Z)

# Television Sony Bravia embedded OS (Applicast enabled), port 52323: Server: RTOS/1.0 UPnP/1.0 KDL-32W5500/1.7
Fingerprint Sony Bravia W5500-series TV
Class Sony | embedded || media device
CPE cpe:/h:sony:bravia_kdl-32w550
SEQ(SP=CD-D7%GCD=1-6%ISR=D5-DF%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W3L%O2=M5B4W3L%O3=M5B4W3L%O4=M5B4W3L%O5=M5B4W3L%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=75-7F%TG=80%W=FFFF%O=M5B4W3L%CC=N%Q=)
T1(R=Y%DF=Y%T=75-7F%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=75-7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=75-7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=75-7F%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=75-7F%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=75-7F%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=8398%RUD=G)
IE(DFI=N%T=75-7F%TG=80%CD=Z)

# Sony Bravia 52" LCD-TV KDL-52W5500
Fingerprint Sony Bravia W5500-series TV
Class Sony | embedded || media device
SEQ(SP=CA-D4%GCD=4|8|C|10|14%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=Y%T=6D-77%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6D-77%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=1550%RUD=G)
IE(DFI=N%T=6D-77%TG=80%CD=Z)

# DLNA on Sony BRAVIA KDL-32W5500 TV set
Fingerprint Sony Bravia W5500-series TV
Class Sony | embedded || media device
SEQ(SP=CC-D6%GCD=1-6%ISR=D3-DD%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W3L%O2=M5B4W3L%O3=M5B4W3L%O4=M5B4W3L%O5=M5B4W3L%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=71-7B%TG=80%W=FFFF%O=M5B4W3L%CC=N)
T1(R=Y%DF=Y%T=71-7B%TG=80%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=71-7B%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=71-7B%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=71-7B%TG=80%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=71-7B%TG=80%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=71-7B%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=84FB%RUD=G)
IE(DFI=N%T=71-7B%TG=80%CD=Z)

# Sony Bravia KDL-52W5500
Fingerprint Sony Bravia W5500-series TV
Class Sony | embedded || media device
SEQ(SP=CC-D6%GCD=1-6%ISR=D4-DE%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=Y%T=73-7D%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=73-7D%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=73-7D%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=73-7D%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=859F%RUD=G)
IE(DFI=N%T=73-7D%TG=80%CD=Z)

# Sony Bravia KDL42W670A SMART TV
# TV model Sony KDL 42W656A
# KDL-40W605B
# KDL-47W805A, Firmware version: PKG4.430BRA
# KDL-55W955
Fingerprint Sony Bravia W600-, W800-, or W900-series TV
Class Sony | embedded || media device
SEQ(SP=EF-10B%GCD=1-6%ISR=103-10F%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11%O2=M5B4ST11%O3=M5B4NNT11%O4=M5B4ST11%O5=M5B4ST11%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sony Bravia BE2 LCD TV (KDL-40X4500)
Fingerprint Sony Bravia X4500-series TV
Class Sony | embedded || media device
CPE cpe:/h:sony:bravia_kdl-40x4500
SEQ(SP=CA-D6%GCD=1-6%ISR=D6-E0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=72%TG=80%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=72%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=72%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=72%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=72%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=72%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=15B2%RUD=G)
IE(DFI=N%T=72%TG=80%CD=Z)

# CMT-MX700Ni/MX750Ni
Fingerprint Sony CMT-MX700Ni audio player
Class Sony | embedded || media device
CPE cpe:/h:sony:cmy-mx700ni
SEQ(SP=F-19%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=99-A3%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# SMP N-200 media device Software version: M10.R.0624
Fingerprint Sony SMP-N200 media player
Class Sony | embedded || media device
CPE cpe:/o:sony:smp-n200
SEQ(SP=C2-CC%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=ST11M5B4NW3%O2=ST11M5B4NW3%O3=NNT11M5B4NW3%O4=ST11M5B4NW3%O5=ST11M5B4NW3%O6=ST11M5B4)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# FWD-40LX2F, embedded card inside a LCD/Projector/etc. Used as a part of sonys embedded signage system called Zirius.
Fingerprint Sony FWD-40LX2F display card
Class Sony | embedded || specialized
CPE cpe:/h:sony:fwd-40lx2f
SEQ(SP=C9-D3%GCD=1-6%ISR=D7-E1%TI=I%II=I%SS=O|S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=73-7D%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=73-7D%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=73-7D%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=73-7D%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=73-7D%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=97F3%RUD=G)
IE(DFI=N%T=73-7D%TG=80%CD=Z)

# Sony PCS-1 VTC
Fingerprint Sony PCS-1 videoconferencing system
Class Sony | embedded || webcam
SEQ(SP=C-16%GCD=1E848|3D090|5B8D8|7A120|98968%ISR=9F-A9%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW4%O2=M578NW4%O3=M280NW4%O4=M5B4NW4%O5=M218NW4%O6=M109)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# This is a Sony PCS-TL30 Video Conferencing Unit
Fingerprint Sony PCS-TL30 video conferencing system
Class Sony | embedded || webcam
CPE cpe:/h:sony:pcs-tl30
SEQ(SP=0-5%GCD=1E848|3D090|5B8D8|7A120|98968%ISR=9C-A6%TI=I%II=I%SS=O|S%TS=U)
OPS(O1=|M5B4NW4%O2=|M578NW4%O3=|M280NW4%O4=|M5B4NW4%O5=%O6=)
WIN(W1=8052|FFFF%W2=802C|FFFF%W3=8020|FFFF%W4=8052|FFFF%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Source Technologies ST-9650 printer, Firmware Version: NR.APS.N370 (Probably Linux --Ed.)
Fingerprint Source Technologies ST-9650 printer
Class Source Technologies | embedded || printer
CPE cpe:/h:sourcetechnologies:st-9650 auto
SEQ(SP=BB-CB%GCD=1-6%ISR=C6-D0%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=FE%TG=FF%W=16D0%O=M5B4NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FE%TG=FF%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# Specialix JETSTREAM 8500 RS232 Network Access Server, Version 2.2.7
Fingerprint Specialix JetStream 8500 RS232 remote access server
Class Specialix | embedded || terminal server
CPE cpe:/h:specialix:jetstream_8500
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=9A-A4%TI=I%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=800%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=7FC%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# sphairon turbolink iad dsl modem. tarballs contains a linux 2.4.20 kernel. http://www.sphairon.com/fld3530/fld2820/e_serv_turbolink_iad_03.html
# Sphairon Turbolink IAD ADSL-Modem/VoIP-Gateway (distributed by the German ISP "Alice")
Fingerprint Sphairon Turbolink IAD DSL modem
Class Sphairon | embedded || broadband router
CPE cpe:/h:sphairon:turbolink_iad
SEQ(SP=C9-D3%GCD=1-6%ISR=C9-D3%TI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=M5B4ST11NW0%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3D%TG=40%W=16D0%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3D%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3D%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=38-42%TG=40%CD=S)

# Star Micronics TSP100 (small thermal receipt printer)
Fingerprint Star Micronics TSP100 receipt printer
Class Star Micronics | embedded || printer
CPE cpe:/h:starmicronics:tsp100
SEQ(SP=0-5%GCD=388|710|A98|E20|11A8%ISR=64-6E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=800%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Stonewater Control Systems - Environmental monitoring appliance
Fingerprint Stonewater Control Systems environmental monitoring appliance
Class Stonewater Control Systems | embedded || specialized
SEQ(SP=3C-46%GCD=100|200|300|400|500%ISR=8D-97%TI=I%II=A780|A78F|A79C|A7AC|A7B8%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=|M400)
WIN(W1=1FF%W2=1FF%W3=1FF%W4=1FF%W5=1FF%W6=0|1FF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1FF%O=M400%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=28-3E%TG=40%CD=S)

# StorageTek SN3250 Router, Version 3.06 2009v
Fingerprint StorageTek SN3250 router
Class StorageTek | embedded || router
CPE cpe:/h:storagetek:sn3250 auto
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Robotic Tape Library, Vendor StorageTek, Product L1400M Interface Control Module, Firmware Level 5.8.0c, Bios Version BIOS 4.23, Booter Version BOOTER 4.11
Fingerprint StorageTek L1400M tape library
Class StorageTek | embedded || storage-misc
SEQ(SP=94-9E%GCD=1-6%ISR=9A-A4%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Virtual Technician Module of Stratus ftServer, It runs something from RMC - Server: RMC Webserver 2.0
Fingerprint Stratus ftServer Virtual Technician Module
Class Stratus | embedded || remote management
CPE cpe:/h:stratus:ftserver_virtual_technician_module
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B0%O2=M578%O3=M280%O4=M5B0%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=2000%O=M5B0%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Vivint control panel
Fingerprint Suga embedded WiFi module
Class Suga | embedded || specialized
SEQ(SP=B4-BE%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=10F8%W2=10F8%W3=10F8%W4=10F8%W5=10F8%W6=10F8)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=111C%O=M5B4NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ILOM for T2000 Server (T2000 had ALOM, not ILOM --Ed.)
Fingerprint Sun Advanced Lights-Out Manager
Class Sun | embedded || remote management
SEQ(SP=BE-C8%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M528ST11NW0%O2=M528ST11NW0%O3=M528NNT11NW0%O4=M528ST11NW0%O5=M528ST11NW0%O6=M528ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M528NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M528ST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sun ILOM running SP Firmware Version 3.0.6.15.c
Fingerprint Sun Integrated Lights-Out Manager
Class Sun | embedded || remote management
CPE cpe:/a:sun:embedded_lights_out_manager
SEQ(SP=F6-10A%GCD=1-6%ISR=F2-10E%TI=Z%II=I%TS=7)
OPS(O1=M564ST11NW1%O2=M564ST11NW1%O3=M564NNT11NW1%O4=M564ST11NW1%O5=M564ST11NW1%O6=M564ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M564NNSNW1%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Sun Solaris RSC (Remote System Control) version 2.2.3
# Sun-Fire-890 RSC remote console RSC version 2.2.3
Fingerprint Sun Remote System Control (RSC) 2.2.3
Class Sun | embedded || remote management
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=98-A2%TI=I%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=Y%T=3B-45%TG=40%CD=S)

# Sun Storage 7210 Unified Storage System
Fingerprint Sun Storage 7210 NAS device
Class Sun | embedded || storage-misc
CPE cpe:/h:sun:storage_7210 auto
SEQ(SP=94-9E%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW5NNS%O2=NNT11M5B4NW5NNS%O3=NNT11M5B4NW5%O4=NNT11M5B4NW5NNS%O5=NNT11M5B4NW5NNS%O6=NNT11M5B4NNS)
WIN(W1=8026%W2=8017%W3=8005%W4=800E%W5=800E%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=8024%O=M5B4NW5NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.11 (Sun Storage 7410)
Fingerprint Sun Storage 7410 NAS device
Class Sun | embedded || storage-misc
CPE cpe:/h:sun:storage_7410 auto
SEQ(SP=89-A3%GCD=1-6%ISR=A0-AA%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW5NNS%O2=NNT11M5B4NW5NNS%O3=NNT11M5B4NW5%O4=NNT11M5B4NW5NNS%O5=NNT11M5B4NW5NNS%O6=NNT11M5B4NNS)
WIN(W1=8026%W2=8017%W3=8005%W4=800E%W5=800E%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=8024%O=M5B4NW5NNS%CC=Y)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=8003%S=O%A=S+%F=AS%O=NNT11M5B4NW5NNS%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun StoreEdge 3310 disk array. firmware version 4.13B
Fingerprint Sun StorEdge 3310 FC storage array
Class Sun | embedded || storage-misc
CPE cpe:/h:sun:storedge_3310_fc_array
SEQ(SP=6C-82%GCD=1-6%ISR=AB-B5%TI=RD%CI=RD|RI%II=RI%TS=U)
OPS(O1=M5B4NNSLLLL%O2=M5B4NNSLLLL%O3=M5B4NNSLLLL%O4=M5B4NNSLLLL%O5=M5B4NNSLLLL%O6=M5B4NNSLLLL)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5B4%O=M5B4NNSLLLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Sun StorEdge 3510 FC
Fingerprint Sun StorEdge 3510 FC storage array
Class Sun | embedded || storage-misc
CPE cpe:/h:sun:storedge_3510_fc_array
SEQ(SP=C-16%GCD=1-6%ISR=2B-35%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NNSLLLL%O2=M5B4NNSLLLL%O3=M5B4NNSLLLL%O4=M5B4NNSLLLL%O5=M5B4NNSLLLL%O6=M5B4NNSLLLL)
WIN(W1=5C8%W2=5C8%W3=5C8%W4=5C8%W5=5C8%W6=5C8)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5C8%O=M5B4NNSLLLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# SunOS spot 5.11 snv_101b i86pc i386 i86pc Solaris
Fingerprint Sun OpenSolaris 2008.11
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=91-9F%GCD=1-6%ISR=A0-AA%TI=I%II=I%SS=S%TS=5)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# OpenSolaris 2008.11
Fingerprint Sun OpenSolaris 2008.11
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=93-9D%GCD=1-6%ISR=9F-A9%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M1B30NW0NNS%O2=NNT11M1B30NW0NNS%O3=NNT11M1B30NW0%O4=NNT11M1B30NW0NNS%O5=NNT11M1B30NW0NNS%O6=NNT11M1B30NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M1B30NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# OpenSolaris 08/11
Fingerprint Sun OpenSolaris 2008.11
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=8C-9C%GCD=1-6%ISR=9E-A8%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M4BENW0NNS%O2=NNT11M4BENW0NNS%O3=NNT11M4BENW0%O4=NNT11M4BENW0NNS%O5=NNT11M4BENW0NNS%O6=NNT11M4BENNS)
WIN(W1=C082%W2=C082%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C26E%O=M4BENW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS vmOpenSolaris 5.11 snv_111b i86pc i386 i86pc Solaris (VirtualBox)
Fingerprint Sun OpenSolaris 2009.06
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=82-9E%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS vmOpenSolaris 5.11 snv_111b i86pc i386 i86pc Solaris (VirtualBox)
Fingerprint Sun OpenSolaris 2009.06
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=8D-9D%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NW1NNS%CC=Y%Q=U)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=U)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=NNT11M5B4NW1NNS%RD=0%Q=U)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# OpenSolaris release snv_129 x86/x86_64,
Fingerprint Sun OpenSolaris snv_129
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=97-A1%GCD=1-6%ISR=AA-B4%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=38-42%TG=40%W=FAF0%O=M5B4NW1NNS%CC=Y%Q=U)
T1(R=Y%DF=Y%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=38-42%TG=40%W=FA09%S=O%A=S+%F=AS%O=NNT11M5B4NW1NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3C-46%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FB-105%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FB-105%TG=FF%CD=S)

# SunOS 5.10 Generic_120012-14 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=8F-99%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=6)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS sol103-e 5.10 Generic_118855-33 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=91-9B%GCD=1-6%ISR=A1-AB%TI=I%CI=I%II=I%SS=S%TS=8)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_137112-02 i86pc i386 i86pc
# SunOS 5.10 Generic_120011-14 sun4u sparc SUNW,Sun-Blade-1500
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=8E-A2%GCD=1-6%ISR=9E-A8%TI=I%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=5B-65%TG=80%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=5B-65%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=250-25A%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=250-25A%TG=FF%CD=S)

# SunOS 5.10 Generic_137111-01 sun4v sparc SUNW,Sun-Fire-T200
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=8D-D7%GCD=1-6%ISR=9F-D3%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C210%O=M564NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=20-3E%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=20-3C%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=20-35%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=23-3F%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=21-32%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=100%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=D56A%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_137112-03 i86pc i386 i86pc
# SunOS 5.10 Generic_137138-09 i86pc i386 i86pc
# SunOS 5.10 Generic_127127-11 sun4u sparc SUNW,Sun-Fire-V880
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=90-B2%GCD=1-6%ISR=9E-C8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_138889-05 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=90-A4%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M2300NW0NNS%O2=NNT11M2300NW0NNS%O3=NNT11M2300NW0%O4=NNT11M2300NW0NNS%O5=NNT11M2300NW0NNS%O6=NNT11M2300NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M2300NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS OUD 5.10 Generic_138889-07 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=FC-106%GCD=1-6%ISR=104-10E%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M1D8NW0NNS%O2=NNT11M1D8NW0NNS%O3=NNT11M1D8NW0%O4=NNT11M1D8NW0NNS%O5=NNT11M1D8NW0NNS%O6=NNT11M1D8NNS)
WIN(W1=C044%W2=C044%W3=C044%W4=C044%W5=C044%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C198%O=M1D8NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_139555-08 sun4v sparc SUNW,SPARC-Enterprise-T5120
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=95-9F%GCD=1-6%ISR=9E-A8%TI=I%TS=7)
OPS(O1=NNT11M4B0NW0NNS%O2=NNT11M4B0NW0NNS%O3=NNT11M4B0NW0%O4=NNT11M4B0NW0NNS%O5=NNT11M4B0NW0NNS%O6=NNT11M4B0NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B%TG=40%W=C1E8%O=M4B0NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3F%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FE%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=D101%RUD=G)
IE(R=N)

# SunOS 5.10 Generic_138888-03 sun4v sparc SUNW,Sun-Blade-T6320
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=FA-108%GCD=1-6%ISR=F8-110%TI=I%CI=RD|RI%II=I%SS=S%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C210%O=M564NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=21-38%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=25-3C%TG=40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=29-3E%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1F-3D%TG=20|40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=28-3E%TG=40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_142901-07 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=94-9E%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B0NW0NNS%O2=NNT11M5B0NW0NNS%O3=NNT11M5B0NW0%O4=NNT11M5B0NW0NNS%O5=NNT11M5B0NW0NNS%O6=NNT11M5B0NNS)
WIN(W1=C56C%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=38-42%TG=40%W=C160%O=M5B0NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_127111-03 sun4v sparc SUNW,SPARC-Enterprise-T5220
# SunOS 5.10 Generic_137111-07 sun4v sparc SUNW,SPARC-Enterprise-T5220
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=FD-10B%GCD=1-6%ISR=108-112%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW3NNS%O2=NNT11M5B4NW3NNS%O3=NNT11M5B4NW3%O4=NNT11M5B4NW3NNS%O5=NNT11M5B4NW3NNS%O6=NNT11M5B4NNS)
WIN(W1=80AE%W2=8017%W3=802D%W4=802F%W5=802F%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8052%O=M5B4NW3NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_144488-04 sun4u sparc SUNW,Netra-T12
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=FE-108%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=8052%O=M5B4NW1NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_142910-17 i86pc i386 i86pc, Solaris 10/update 9
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=FE-108%GCD=1-6%ISR=102-10C%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C210%O=M564NW0NNS%CC=Y)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_147441-26 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=91-9B%GCD=1-6%ISR=9E-A8%TI=I%TS=7)
OPS(O1=NNT11|NNT11M5B4NW0NNS%O2=NNT11|NNT11M5B4NW0NNS%O3=NNT11|NNT11M5B4NW0%O4=NNT11|NNT11M5B4NW0NNS%O5=NNT11|NNT11M5B4NW0NNS%O6=NNT11|NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=5B-65%TG=80%W=C1E8%O=|M5B4NW0NNS%CC=N|Y%Q=)
T1(R=Y%DF=Y%T=5B-65%TG=80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=250-25A%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=250-25A%TG=FF%CD=S)

# SunOS 5.10
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=94-9E%GCD=1-6%ISR=9E-A8%TI=I|RD%CI=I%II=I%SS=O|S%TS=7|9)
OPS(O1=NNT11M514NW0NNS%O2=NNT11M514NW0NNS%O3=NNT11M514NW0%O4=NNT11M514NW0NNS%O5=NNT11M514NW0NNS%O6=NNT11M514NNS)
WIN(W1=C438%W2=C438%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C0F8%O=M514NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_147147-26 sun4v sparc SUNW,SPARC-Enterprise-T5220
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=94-9E%GCD=1-6%ISR=A1-AB%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M556NW0NNS%O2=NNT11M556NW0NNS%O3=NNT11M556NW0%O4=NNT11M556NW0NNS%O5=NNT11M556NW0NNS%O6=NNT11M556NNS)
WIN(W1=C3B2%W2=C3B2%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C018%O=M556NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_147148-26 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=92-9C%GCD=1-6%ISR=A0-AA%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M538NW0NNS%O2=NNT11M538NW0NNS%O3=NNT11M538NW0%O4=NNT11M538NW0NNS%O5=NNT11M538NW0NNS%O6=NNT11M538NNS)
WIN(W1=C488%W2=C488%W3=C1CC%W4=C050%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C118%O=M538NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 HW3/05 Generic_118833-24 sun4u sparc SUNW,Sun-Fire-880
# SunOS 5.10 Generic_127111-03 sun4v sparc SUNW,Sun-Fire-T200
Fingerprint Sun Solaris 10 (SPARC)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=F3-10B%GCD=1-6%ISR=107-111%TI=I%TS=A)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS nj-web20 5.10 Generic_118833-24 sun4u sparc SUNW,Sun-Fire-V210
Fingerprint Sun Solaris 10 (SPARC)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=8F-A3%GCD=1-6%ISR=9E-A8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C210%O=M564NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=23-33%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=22-40%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=27-3D%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=23-3F%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=23-40%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=2F22%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_125100-10 sun4u sparc SUNW,UltraAX-i2
Fingerprint Sun Solaris 10 (SPARC)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=100-10A%GCD=1-6%ISR=103-10D%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C210%O=M564NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=22-30%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=22-39%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=1F-3B%TG=20|40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1F-2C|30-3D%TG=20|40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=1F-30|34-3E%TG=20|40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_125100-10 sun4v sparc SUNW,Sun-Fire-T200
Fingerprint Sun Solaris 10 (SPARC)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=92-A0%GCD=1-6%ISR=9E-A8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=1F-3C%TG=20|40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=1F-36%TG=20|40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=27-3A%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1F-38%TG=20|40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=1F-2A|2D-3C%TG=20|40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_127127-11 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 10 (SPARC)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=8B-95%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=370F%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS unknown 5.10 Generic_118855-15 i86pc i386 i86pc
Fingerprint Sun Solaris 10 (x86)
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=83-A3%GCD=1-6%ISR=9D-A7%TI=I%TS=7)
OPS(O1=NNT11M564NW0NNS%O2=NNT11M564NW0NNS%O3=NNT11M564NW0%O4=NNT11M564NW0NNS%O5=NNT11M564NW0NNS%O6=NNT11M564NNS)
WIN(W1=C060%W2=C060%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C210%O=M564NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=22-41%TG=40%W=80%S=A|O%A=O|S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=Y%T=22-40%TG=40%W=100%S=A|O%A=O|S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=27-3E%TG=40%W=400%S=A|O%A=O|S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=26-41%TG=40%W=8000%S=A|O%A=O|S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=Y%T=2B-3E%TG=40%W=FFFF%S=A|O%A=O|S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun Solaris 11
# Sun ZFS Storage Appliance 7420 firmware revision ak-nas@2011.04.24.2.1,1-1.15
# SunOS 5.11 joyent_20140710T224431Z i86pc i386 i86pc Solaris (SmartOS)
Fingerprint Sun Solaris 11
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
SEQ(SP=8A-D6%GCD=1-6%ISR=9D-FD%TI=I%CI=I|RI%TS=7|A)
OPS(O1=ST11M5B4NW5%O2=ST11M5B4NW5%O3=NNT11M5B4NW5%O4=ST11M5B4NW5%O5=ST11M5B4NW5%O6=ST11M5B4)
WIN(W1=8026%W2=8017%W3=8005%W4=800E%W5=800E%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=8024%O=M5B4NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=8003%S=O%A=S+%F=AS%O=ST11M5B4NW5%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun Solaris 11
Fingerprint Sun Solaris 11
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
SEQ(SP=8A-D6%GCD=1-6%ISR=9D-FD%TI=I%CI=RI%TS=7|A)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun Solaris 11
Fingerprint Sun Solaris 11
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
SEQ(SP=96-A0%GCD=1-6%ISR=9D-A7%TI=I|RD%TS=7|8)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FA09%S=O%A=O|S+%F=AS%O=ST11M5B4NW1%RD=0)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS  5.11 11.0 i86pc i386 i86pc
Fingerprint Sun Solaris 11
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
SEQ(SP=FD-109%GCD=1-6%ISR=101-111%TI=I%CI=RD%II=I%SS=S%TS=7)
OPS(O1=ST11M564NW1%O2=ST11M564NW1%O3=NNT11M564NW1%O4=ST11M564NW1%O5=ST11M564NW1%O6=ST11M564)
WIN(W1=FB28%W2=FB28%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAAA%O=M564NNSNW1%CC=Y)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=Y%T=24-3F%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0)
T3(R=Y%DF=N%T=22-3D%TG=40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0)
T4(R=Y%DF=Y%T=20-3E%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=26-3F%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0)
T7(R=Y%DF=N%T=25-3F%TG=40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS xxxxxxxx 5.11 snv_151a i86pc i386 i86pc
Fingerprint Sun Solaris 11 (snv_151a) or OpenIndiana oi_147
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
Class illumos | OpenIndiana || general purpose
CPE cpe:/o:illumos:openindiana auto
SEQ(SP=94-9E%GCD=1-6%ISR=A0-AA%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M2300NW1%O2=ST11M2300NW1%O3=NNT11M2300NW1%O4=ST11M2300NW1%O5=ST11M2300NW1%O6=ST11M2300)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M2300NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M2300NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# OpenIndiana SunOS 5.11      oi_147  September 2010
# SunOS 5.11 oi_147 i86pc i386 i86pc Solaris
# Sun Blade 1000 Solaris 11
# SunOS 5.11 snv_151a i86pc i386 i86pc Solaris
# SunOS 5.11 snv_151a sun4u sparc SUNW,Sun-Blade-100 Solaris
# OpenIndiana version oi_148
# OpenIndiana (powered by illumos)    SunOS 5.11    oi_151a    December 2011, 5.11 oi_151a i86pc i386 i86pc Solaris
# Joyent's SmartOS which is based on Illumos which is based on OpenSolaris.
# Solaris 11 x86
Fingerprint Sun Solaris 11 (snv_151a) or OpenIndiana oi_147 - oi_151a
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:5.11 auto
Class illumos | OpenIndiana || general purpose
CPE cpe:/o:illumos:openindiana auto
SEQ(SP=8A-D6%GCD=1-6%ISR=9D-FD%TI=I%CI=I%II=I%SS=S%TS=7|A)
OPS(O1=ST11M5B4NW1%O2=ST11M5B4NW1%O3=NNT11M5B4NW1%O4=ST11M5B4NW1%O5=ST11M5B4NW1%O6=ST11M5B4)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=FAF0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=37-41%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M5B4NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS Sun 5.11 11.3 sun4u sparc SUNW,SPARC-Enterprise Solaris
Fingerprint Sun Solaris 11.3
Class Sun | Solaris | 11 | general purpose
CPE cpe:/o:sun:sunos:11.3 auto
SEQ(SP=FF-109%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=ST11M2300NW1%O2=ST11M2300NW1%O3=NNT11M2300NW1%O4=ST11M2300NW1%O5=ST11M2300NW1%O6=ST11M2300)
WIN(W1=FBB4%W2=FC1E%W3=FA38%W4=FABE%W5=FABE%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FAF0%O=M2300NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FA09%S=O%A=S+%F=AS%O=ST11M2300NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.5.1 Generic_103640-36 sun4m sparc SUNW,SPARCstation-10 Solaris
# SunOS 5.5.1 Generic_103640-31 sun4m sparc
Fingerprint Sun Solaris 2.5.1 (SPARC)
Class Sun | Solaris | 2.X | general purpose
CPE cpe:/o:sun:sunos:5.5.1 auto
SEQ(SP=8E-A2%GCD=1-6%ISR=99-A7%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=2238%W2=2648%W3=2300%W4=2398%W5=2398%W6=2332)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2238%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=26-3A%TG=29-39%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=26-3A%TG=27-39%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=26-3A%TG=27-3A%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=26-3A%TG=26-39%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.5.1 Generic_103640-42 sun4m sparc SUNW,SPARCstation-20
Fingerprint Sun Solaris 2.5.1 (SPARC)
Class Sun | Solaris | 2.X | general purpose
CPE cpe:/o:sun:sunos:5.5.1 auto
SEQ(SP=8F-99%GCD=1-6%ISR=95-9F%TI=I%II=I%SS=S%TS=U)
OPS(O1=M564%O2=M564%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=25BC%W2=25BC%W3=2300%W4=2398%W5=2398%W6=2332)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=25BC%O=M564%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=21-34%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=22-33%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=21-39%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=1F-3D%TG=20|40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=27-40%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=23-3A%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=436C%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10
# SunOS 5.6 Generic_105181-33 sun4u sparc SUNW,Ultra-Enterprise
# SunOS 5.6 Generic_105182-35 i86pc i386 i86pc
# SunOS 5.6 Generic_105181-26 sun4u sparc SUNW,Ultra-1 Solaris
# SunOS 5.6 Generic_105181-31 sun4u sparc SUNW,Ultra-Enterprise
Fingerprint Sun Solaris 2.6
Class Sun | Solaris | 2.X | general purpose
CPE cpe:/o:sun:sunos:5.6 auto
SEQ(SP=8D-AB%GCD=1-6%ISR=97-AB%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0M5B4%O2=NNT11NW0M578%O3=NNT11NW0M280%O4=NNT11NW0M218%O5=NNT11NW0M218%O6=NNT11M109)
WIN(W1=2798%W2=25F4%W3=2258%W4=22CC%W5=22CC%W6=2297)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2238%O=NW0M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=23-3B%TG=20|40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=23-3B%TG=20|40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=23-3B%TG=20|40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=23-3B%TG=20|40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# 5.10 Generic_127111-03 sun4v sparc
Fingerprint Sun Solaris 10
Class Sun | Solaris | 5.X | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=102-10C%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun OS 5.7
Fingerprint Sun Solaris 7
Class Sun | Solaris | 7 | general purpose
CPE cpe:/o:sun:sunos:5.7 auto
SEQ(SP=8E-98%GCD=1-6%ISR=98-A4%TI=I%CI=RD%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM564%O2=NNT11NW0NNSM564%O3=NNT11NW0M280%O4=NNT11NW0NNSM218%O5=NNT11NW0NNSM218%O6=NNT11NNSM109)
WIN(W1=2568%W2=2568%W3=2258%W4=22CC%W5=22CC%W6=2297)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=25BC%O=NW0NNSM564%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=25-3D%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=20-3F%TG=40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=27-3F%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=22-36%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=22-30%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=20-32%TG=40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS hostname 5.7 Generic_Patch sun4u sparc SUNW,Ultra-1 Solaris
Fingerprint Sun Solaris 7 (SPARC)
Class Sun | Solaris | 7 | general purpose
CPE cpe:/o:sun:sunos:5.7 auto
SEQ(SP=84-A0%GCD=1-6%ISR=93-A1%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM578%O3=NNT11NW0M280%O4=NNT11NW0NNSM218%O5=NNT11NW0NNSM218%O6=NNT11NNSM109)
WIN(W1=2798%W2=25F4%W3=2258%W4=22CC%W5=22CC%W6=2297)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2238%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=21-3F%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=21-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=22-40%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=20-3F%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS <hostname> 5.7 Generic_106541-23 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 7 (SPARC)
Class Sun | Solaris | 7 | general purpose
CPE cpe:/o:sun:sunos:5.7 auto
SEQ(SP=FB-105%GCD=1-6%ISR=108-112%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11|NNT11NW0NNSM5B4%O2=NNT11|NNT11NW0NNSM578%O3=NNT11|NNT11NW0M280%O4=NNT11|NNT11NW0NNSM218%O5=NNT11|NNT11NW0NNSM218%O6=NNT11|NNT11NNSM109)
WIN(W1=2798%W2=25F4%W3=2258%W4=22CC%W5=22CC%W6=2297)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2238%O=|NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=20-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=24-3F%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=28-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=23-3E%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.7 Generic sun4u sparc SUNW,Ultra-1
Fingerprint Sun Solaris 7 (SPARC)
Class Sun | Solaris | 7 | general purpose
CPE cpe:/o:sun:sunos:5.7 auto
SEQ(SP=EA-106%GCD=1-6%ISR=100-110%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM564%O2=NNT11NW0NNSM564%O3=NNT11NW0M280%O4=NNT11NW0NNSM218%O5=NNT11NW0NNSM218%O6=NNT11NNSM109)
WIN(W1=2568%W2=2568%W3=2258%W4=22CC%W5=22CC%W6=2297)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=25BC%O=NW0NNSM564%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=22-2C|2E-3F%TG=40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=2B-3A%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=25-40%TG=40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=34-3E%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=24-3F%TG=40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=21-38%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-62 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 8
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=93-9D%GCD=1-6%ISR=9E-A8%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M550NW0NNS%O2=NNT11M550NW0NNS%O3=NNT11M550NW0%O4=NNT11M550NW0NNS%O5=NNT11M550NW0NNS%O6=NNT11M550NNS)
WIN(W1=C2D4%W2=C2D4%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C490%O=M550NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_108528-11 sun4u sparc SUNW,Ultra-5_10 Solaris
# SunOS unknown 5.8 Generic_108528-13 sun4u sparc SUNW,Sun-Blade-100
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=8D-9F%GCD=1-6%ISR=A0-AA%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS  5.8 Generic_108528-19 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=DF-E9%GCD=1-6%ISR=108-112%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=38-42%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=100%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FE%TG=FF%CD=S)

# Solaris 8: SunOS 5.8 Generic_117350-39
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=F8-102%GCD=1-6%ISR=F7-10D%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_108528-15 sun4u sparc SUNW,Ultra-250
# SunOS 5.8 Generic_108529-01 i86pc i386 i86pc (on vmware)
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=92-A6%GCD=1-6%ISR=A2-AC%TI=I%II=I%SS=S%TS=8)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=37-45%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=37-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_108528-29 sun4u sparc SUNW,Sun-Fire-280R
# SunOS 5.8 Generic_117350-39 sun4u sparc SUNW,Sun-Fire-480R
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=8E-160%GCD=1-6%ISR=98-140%TI=I%CI=I%II=I%SS=S%TS=7|9)
OPS(O1=NNT11|NNT11NW0NNSM5B4%O2=NNT11|NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11|NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-20 sun4u sparc SUNW,Sun-Fire-V440
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=96-A6%GCD=1-6%ISR=A1-AB%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW1NNSM5B4%O2=NNT11NW1NNSM5B4%O3=NNT11NW1M5B4%O4=NNT11NW1NNSM5B4%O5=NNT11NW1NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=8052%O=NW1NNSM5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-45 sun4u sparc SUNW,UltraAX-i2
# SunOS 5.8 Generic_117350-46 sun4u sparc SUNW,Ultra-4
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=FA-104%GCD=1-6%ISR=100-114%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-24 sun4u sparc SUNW,Sun-Fire-880
# SunOS 5.8 Generic_117350-13 sun4u sparc SUNW,Sun-Blade-1000
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=95-AF%GCD=1-6%ISR=9D-AB%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-33 sun4u sparc SUNW,Sun-Blade-1000
# SunOS 5.8 Generic_117350-39 sun4u sparc SUNW,Ultra-5_10
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=89-9F%GCD=1-6%ISR=9E-A8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS  5.8 Generic_117350-39 sun4u sparc SUNW,Sun-Fire-V210
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=91-A1%GCD=1-6%ISR=9E-A8%TI=I%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=5B-65%TG=80%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=5B-65%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=5F-69%TG=80%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=250-25A%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=250-25A%TG=FF%CD=S)

# SunOS 5.8 Generic_108528-25 sun4u sparc SUNW,Ultra-80
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=A0-AC%GCD=1-6%ISR=A6-B7%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW1NNSM5AC%O2=NNT11NW1NNSM5AC%O3=NNT11NW1M5AC%O4=NNT11NW1NNSM5AC%O5=NNT11NW1NNSM5AC%O6=NNT11NNSM5AC)
WIN(W1=8160%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8274%O=NW1NNSM5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_108528-29 sun4u sparc SUNW,Ultra-60
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=93-E7%GCD=1-6%ISR=A5-C9%TI=I%TS=7)
OPS(O1=NNT11NW1NNSM5B4%O2=NNT11NW1NNSM5B4%O3=NNT11NW1M5B4%O4=NNT11NW1NNSM5B4%O5=NNT11NW1NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8052%O=NW1NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-45 sun4u sparc SUNW,Sun-Fire-480R
# SunOS 5.8 Generic_117350-46 sun4u sparc SUNW,Sun-Fire-15000
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=8A-9F%GCD=1-6%ISR=9E-A8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=8218%W2=8220%W3=8204%W4=80F4%W5=80F4%W6=807A)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=832C%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_117350-61 sun4u sparc SUNW,Ultra-1
Fingerprint Sun Solaris 8 (SPARC)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=8C-A2%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW0NNSM5B4%O2=NNT11NW0NNSM5B4%O3=NNT11NW0M5B4%O4=NNT11NW0NNSM5B4%O5=NNT11NW0NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=6028%W2=6198%W3=6220%W4=6034%W5=6034%W6=60DA)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=60F4%O=NW0NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=N)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.8 Generic_108529-11 i86pc i386 i86pc Solaris
Fingerprint Sun Solaris 8 (x86)
Class Sun | Solaris | 8 | general purpose
CPE cpe:/o:sun:sunos:5.8 auto
SEQ(SP=8A-9E%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11NW1NNSM5B4%O2=NNT11NW1NNSM5B4%O3=NNT11NW1M5B4%O4=NNT11NW1NNSM5B4%O5=NNT11NW1NNSM5B4%O6=NNT11NNSM5B4)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=37-45%TG=40%W=8052%O=NW1NNSM5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=37-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_118559-39 i86pc i386 i86pc
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=FF-109%GCD=1-6%ISR=101-10B%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=8140%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=825A%O=M5B4NW1NNS%CC=Y%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_122300-36 sun4u sparc SUNW,Sun-Fire
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=83-A9%GCD=1-6%ISR=A2-AC%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=8218%W2=8220%W3=8204%W4=80F4%W5=80F4%W6=807A)
ECN(R=Y%DF=Y%T=38-42%TG=40%W=832C%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=100%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=100%TG=FF%CD=S)

# SunOS 5.9 Generic_118558-34 sun4u sparc SUNW,Sun-Blade-100
Fingerprint Sun Solaris 9
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=7B-A5%GCD=1-6%ISR=A1-AB%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=N)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_118558-28 sun4u sparc SUNW,Sun-Blade-1500
Fingerprint Sun Solaris 9 (SPARC)
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=FC-106%GCD=1-6%ISR=FD-113%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=1B-25|3B-45%TG=20|40%W=80%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=1B-25|3B-45%TG=20|40%W=100%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=1B-25|3B-45%TG=20|40%W=400%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1B-25|3B-45%TG=20|40%W=8000%S=A%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25|3B-45%TG=20|40%W=FFFF%S=A%A=S%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(R=N)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_112234-05 i86pc i386 i86pc Solaris
Fingerprint Sun Solaris 9 (x86)
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=8A-A2%GCD=1-6%ISR=A1-AB%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8052%O=M5B4NW1NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_118559-11 i86pc i386 i86pc
# solaris 10 x86
Fingerprint Sun Solaris 9 or 10
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
SEQ(SP=92-9C%GCD=1-6%ISR=9D-A7%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=8052%O=M5B4NW1NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_118558-10 sun4u sparc SUNW,Sun-Fire-15000
# Solaris 10; uname: SunOS 5.10 Generic_118855-33 i86pc i386 i86pc
# SunOS 5.11 snv_64a sun4u sparc SUNW,Sun-Blade-1000
Fingerprint Sun Solaris 9 or 10
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=90-A4%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=O%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-3D%TG=40%W=C1E8%O=M5B4NW0NNS%CC=N|Y%Q=)
T1(R=Y%DF=Y%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.9 Generic_118558-39 sun4u sparc SUNW,Sun-Fire-V215
# SunOS 5.10 Generic_118833-24 sun4u sparc SUNW,Sun-Fire-V210
# SunOS 5.9 Generic_122300-10 sun4u sparc SUNW,A70
# SunOS 5.9 Generic_112233-12 sun4u sparc SUNW,Sun-Fire-280R
# Solaris 10; uname: SunOS 5.10 Generic_118822-25 sun4u sparc SUNW,Sun-Blade-1000
# SunOS 5.10 Generic sun4u sparc SUNW,Sun-Blade-1500
# SunOS 5.10 Generic_118833-18 sun4u sparc SUNW,Sun-Fire-280R
# SunOS 5.9 Generic_118558-30 sun4u sparc SUNW,Sun-Fire-V440
# SunOS 5.10 Generic_125100-10 sun4u sparc SUNW,Sun-Fire-280R
Fingerprint Sun Solaris 9 or 10 (SPARC)
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
SEQ(SP=F3-10B%GCD=1-6%ISR=101-10F%TI=I%II=I%SS=O|S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 5.10 Generic_127112-05 i86pc i386 i86pc
# Solaris 10 on UltraSPARC T1
# SunOS 5.9 Generic_122300-03 sun4us sparc FJSV,GPUZC-M
# SunOS 5.10 Generic_125101-10 i86pc i386 i86pc
# OpenSolaris 2009.06 snv_111b X86, SunOS 5.11 snv_111b i86pc i386 i86pc
# Ultra 10 uni-processor
# SunOS sparc10 5.10 Generic_118822-30 sun4u sparc SUNW,Ultra-5_10 Solaris
# Solaris 10 x86
# OpenSolaris (aka Solaris Nevada)
# SunOS 5.10 Generic_142910-17 i86pc i386 i86pc
Fingerprint Sun Solaris 9 or 10, or OpenSolaris 2009.06 snv_111b
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
Class Sun | Solaris | 10 | general purpose
CPE cpe:/o:sun:sunos:5.10 auto
Class Sun | OpenSolaris || general purpose
CPE cpe:/o:sun:opensolaris auto
SEQ(SP=8C-D4%GCD=1-6%ISR=9E-D2%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW0NNS%O2=NNT11M5B4NW0NNS%O3=NNT11M5B4NW0%O4=NNT11M5B4NW0NNS%O5=NNT11M5B4NW0NNS%O6=NNT11M5B4NNS)
WIN(W1=C050%W2=C330%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=C1E8%O=M5B4NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# Sun Solaris 9
# OpenSolaris
# Solaris 10
Fingerprint Sun Solaris 9 or Oracle Solaris 10
Class Sun | Solaris | 9 | general purpose
CPE cpe:/o:sun:sunos:5.9 auto
Class Oracle | Solaris | 10 | general purpose
CPE cpe:/o:oracle:solaris:10 auto
SEQ(SP=91-9B%GCD=1-6%ISR=9E-A8%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M5B4NW1NNS%O2=NNT11M5B4NW1NNS%O3=NNT11M5B4NW1%O4=NNT11M5B4NW1NNS%O5=NNT11M5B4NW1NNS%O6=NNT11M5B4NNS)
WIN(W1=8218%W2=8220%W3=80CA%W4=80F4%W5=80F4%W6=FFF7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=8052%O=M5B4NW1NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# 5.10 Generic_147148-26 i86pc i386 i86pc
Fingerprint Sun Solaris 10
Class Sun | SunOS | 10 | general purpose
CPE cpe:/o:sun:sunos:10 auto
SEQ(SP=95-9F%GCD=1-6%ISR=9F-A9%TI=I%II=I%SS=S%TS=7)
OPS(O1=NNT11M529NW0NNS%O2=NNT11M529NW0NNS%O3=NNT11M529NW0%O4=NNT11M529NW0NNS%O5=NNT11M529NW0NNS%O6=NNT11M529NNS)
WIN(W1=C24E%W2=C24E%W3=C1CC%W4=C068%W5=C068%W6=C0B7)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=C416%O=M529NW0NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=FA-104%TG=FF%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=Y%T=FA-104%TG=FF%CD=S)

# SunOS 4.1.3 sun4m on SuperSPARC
Fingerprint Sun SunOS 4.1.3 (SPARC)
Class Sun | SunOS | 4.X | general purpose
CPE cpe:/o:sun:sunos:4.1.3 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# SunPower spr-pmr-gtwy
Fingerprint SunPower solar monitoring device (uIP stack)
Class SunPower | embedded || power-device
Class RISE SICS | uIP || specialized
CPE cpe:/a:rise_sics:uip
SEQ(SP=0-5%GCD=0%ISR=0-5%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5BA%O2=M5BA%O3=M5BA%O4=M5BA%O5=M5BA%O6=M5BA)
WIN(W1=5BA%W2=5BA%W3=5BA%W4=5BA%W5=5BA%W6=5BA)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5BA%O=M5BA%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=A%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=A%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S+%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Dedicated SuperMicro lights out management based on IPMI including remote KVM for a 1u ivy bridge Intel Xeon system.
Fingerprint Supermicro IPMI remote management
Class Supermicro | embedded || remote management
SEQ(SP=C5-CF%GCD=1-6%ISR=C6-D0%TI=Z%II=I%TS=7|9)
OPS(O1=M545ST11NW1%O2=M545ST11NW1%O3=M545NNT11NW1%O4=M545ST11NW1%O5=M545ST11NW1%O6=M545ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M545NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Super Micro IPMI (Management Interface for servers) Version 1.86
# Super Micro IPMI (Management Interface for servers) Version 2.66
Fingerprint Supermicro IPMI remote management
Class Supermicro | embedded || remote management
SEQ(SP=C5-CF%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M51CST11NW1%O2=M51CST11NW1%O3=M51CNNT11NW1%O4=M51CST11NW1%O5=M51CST11NW1%O6=M51CST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M51CNNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M51CST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Syllable Desktop 0.6.7
Fingerprint Syllable Desktop 0.6.7
Class Syllable | Desktop | 0.6.X | general purpose
CPE cpe:/o:syllable:desktop:0.6.7 auto
SEQ(SP=5A-64%GCD=1-6%ISR=67-71%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M5B4%O4=M5B4%O5=M218%O6=M109)
WIN(W1=7FF0%W2=7FF0%W3=7FF0%W4=7FF0%W5=7FF0%W6=7FF0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=7FF0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=7FF0%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=Y%T=7B-85%TG=80%CD=Z)

# symantec firewall appliance 100, Firmware V1 Rel 62
# Symantec Firewall/VPN 200, Firmware-Version V1 Rel 4I
Fingerprint Symantec Firewall/VPN 100 or 200
Class Symantec | embedded || firewall
CPE cpe:/h:symantec:firewall_vpn_appliance_100
CPE cpe:/h:symantec:firewall_vpn_appliance_200
SEQ(SP=1F-43%GCD=1000|2000|3000|4000|5000%ISR=85-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4T11NN%O2=M5B4%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=70%UN=5DC%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-3D%TG=40%CD=Z)

# Symantec Security Gateway 5620 Firewall
Fingerprint Symantec Gateway Security 5620 firewall
Class Symantec | embedded || firewall
CPE cpe:/h:symantec:gateway_security_5620
SEQ(SP=FF-109%GCD=1-6%ISR=FC-106%TI=Z%TS=U)
OPS(O1=M5B4NNSNW0%O2=M5B4NNSNW0%O3=M5B4NW0%O4=M5B4NNSNW0%O5=M5B4NNSNW0%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Symantec VelociRaptor 1.5
Fingerprint Symantec VelociRaptor 1.5 firewall
Class Symantec | embedded || firewall
CPE cpe:/h:symantec:velociraptor_1.5
CPE cpe:/a:symantec:velociraptor
SEQ(SP=FE-10A%GCD=1-6%ISR=106-110%TI=I%TS=U)
OPS(O1=M5B4NNSNW0%O2=M578NNSNW0%O3=M280NW0%O4=M218NNSNW0%O5=M218NNSNW0%O6=M109NNS)
WIN(W1=7D78%W2=7DC8%W3=7F80%W4=7FB8%W5=7FB8%W6=7F53)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=7D78%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1A-24%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Nokia Symbian^3
Fingerprint Symbian^3
Class Symbian OS | Symbian OS | 3 | phone
CPE cpe:/o:symbianos:symbian_os:3 auto
SEQ(SP=A7-B1%GCD=1-6%ISR=B2-BC%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4NNT11NW2NNS%O2=M5B4NNT11NW2NNS%O3=M5B4NNT11NW2%O4=M5B4NNT11NW2NNS%O5=M5B4NNT11NW2NNS%O6=M5B4NNT11NNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FAF0)
ECN(R=Y%DF=N%T=40-4A%TG=80%W=FFFF%O=M5B4NW2NNS%CC=N%Q=)
T1(R=Y%DF=N%T=40-4A%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=40-4A%TG=80%W=FFFF%S=O%A=S+%F=AS%O=M5B4NNT11NW2NNS%RD=0%Q=)
T4(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=40-4A%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=40-4A%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=40-4A%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=40-4A%TG=80%CD=S)

# Symbol WAP, firmware version 04.00-25 Model AP-2411
Fingerprint Symbol AP-2411 switch
Class Symbol | embedded || switch
CPE cpe:/h:symbol:ap-2411 auto
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4B-55%TI=RD%TS=U)
OPS(O1=|M5B4%O2=|M5B4%O3=|M5B4%O4=|M5B4%O5=|M5B4%O6=|M5B4)
WIN(W1=1|16D0%W2=3F|16D0%W3=4|16D0%W4=4|16D0%W5=10|16D0%W6=200|16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=O|S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Symbol AP-3021 firmware 04.02-19
Fingerprint Symbol AP-3021 switch
Class Symbol | embedded || switch
CPE cpe:/h:symbol:ap-3021 auto
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M5B4%O2=|M5B4%O3=|M5B4%O4=|M5B4%O5=|M5B4%O6=|M5B4)
WIN(W1=1|16D0%W2=3F|16D0%W3=4|16D0%W4=4|16D0%W5=10|16D0%W6=200|16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Symbol ES3000 24-port ethernet PoE switch v1.0.0.0-012R / Apr 26 2004 11:44:48
Fingerprint Symbol ES3000 switch
Class Symbol | embedded || switch
CPE cpe:/h:symbol:es3000 auto
SEQ(SP=0-5%GCD=388|710|A98|E20|11A8%ISR=64-6E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M218%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=2400%W2=2400%W3=2400%W4=2400%W5=2400%W6=2400)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=2400%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=2400%S=O%A=O%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Symbol Spectrum24 4131 Access Point
# Model AP-4131; AP firmware: 03.70-72; RF firmware: F3.70-32
Fingerprint Symbol Spectrum24 4131 WAP
Class Symbol | embedded || WAP
CPE cpe:/h:symbol:spectrum24_4131 auto
SEQ(SP=B-15%GCD=32|64|96|C8|FA|12C%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M514%O2=|M514%O3=|M514%O4=|M514%O5=|M514%O6=|M514)
WIN(W1=1|16D0%W2=3F|16D0%W3=4|16D0%W4=4|16D0%W5=10|16D0%W6=200|16D0)
ECN(R=Y%DF=N%T=41%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=41%TG=40%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=41%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=41%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=41%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=41%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=41%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=41%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=41%TG=40%CD=S)

# Symbol WS500 Wireless Switch
Fingerprint Symbol WS500 wireless switch
Class Symbol | embedded || WAP
CPE cpe:/h:symbol:ws500 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=4470%W2=41A0%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=402E%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Symbol WS5000 Wireless Switch
# Software 1.4.3.0-012R, firmware 2.2 (7/9/02)
Fingerprint Symbol WS5000 wireless switch
Class Symbol | embedded || WAP
CPE cpe:/h:symbol:ws5000 auto
SEQ(SP=5-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=4204%W2=4204%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3D-47%TG=40%W=4204%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3D-47%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3D-47%TG=40%W=402E%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3D-47%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3D-47%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3D-47%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FC-106%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FC-106%TG=FF%CD=S)

# Symbol WS5000 Wireless Switch
Fingerprint Symbol WS5000 wireless switch
Class Symbol | embedded || WAP
CPE cpe:/h:symbol:ws5000 auto
SEQ(SP=0-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=4470%W2=41A0%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Priva heating control manager
# Linux 2.6.32.12 #1955 Sat Nov 26 14:50:54 CST 2011 armv5tel GNU/Linux synology_88f6281_211j
Fingerprint Synology DiskStation Manager 3.2 or Priva heating control manager (Linux 2.6.32)
Class Synology | DiskStation Manager | 3.X | storage-misc
CPE cpe:/a:synology:diskstation_manager:3.2 auto
Class Priva | embedded || specialized
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.32 auto
SEQ(SP=C2-CC%GCD=1-6%ISR=C5-CF%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=39-43%TG=40%W=16D0%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=39-43%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=39-43%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=39-43%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=39-43%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=39-43%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=39-43%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=39-43%TG=40%CD=S)

# DSM 5
Fingerprint Synology DiskStation Manager 5 (Linux)
Class Synology | DiskStation Manager | 5.X | storage-misc
CPE cpe:/a:synology:diskstation_manager:5 auto
Class Linux | Linux || general purpose
CPE cpe:/o:linux:linux_kernel auto
SEQ(SP=101-10B%GCD=1-6%ISR=101-10B%TI=Z%CI=Z%TS=7)
OPS(O1=M55EST11NW4%O2=M55EST11NW4%O3=M55ENNT11NW4%O4=M55EST11NW4%O5=M55EST11NW4%O6=M55EST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M55ENNSNW4%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Synology DS411j running DSM 5.2-5644 Update 1
Fingerprint Synology DiskStation Manager 5.2-5644
Class Synology | DiskStation Manager | 5.X | storage-misc
CPE cpe:/a:synology:diskstation_manager:5.2 auto
SEQ(SP=C4-CE%GCD=1-6%ISR=CB-D5%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Synology NAS DS1010+ running DSM 5.2-5644 Update 5
Fingerprint Synology DiskStation Manager 5.2-5644
Class Synology | DiskStation Manager | 5.X | storage-misc
CPE cpe:/a:synology:diskstation_manager:5.2 auto
SEQ(SP=F5-FF%GCD=1-6%ISR=103-10D%TI=Z%CI=I|RD%II=I%TS=A|B|D)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# DSM 6 on DS213+, Linux 2.6.32.12 #7135 SMP Thu Oct 15 13:34:36 CST 2015 ppc GNU/Linux synology_qoriq_213+
Fingerprint Synology DiskStation Manager 6 (Linux 2.6.32)
Class Synology | DiskStation Manager | 6.X | storage-misc
CPE cpe:/a:synology:diskstation_manager:6 auto
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.32 auto
SEQ(SP=C7-D1%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=8|A)
OPS(O1=M1F18ST11NW5%O2=M1F18ST11NW5%O3=M1F18NNT11NW5%O4=M1F18ST11NW5%O5=M1F18ST11NW5%O6=M1F18ST11)
WIN(W1=3E18%W2=3E18%W3=3E18%W4=3E18%W5=3E18%W6=3E18)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3E30%O=M1F18NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3E18%S=O%A=S+%F=AS%O=M1F18ST11NW5%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Synology RT1900ac router
Fingerprint Synology RT1900ac router
Class Synology | embedded || router
CPE cpe:/h:synology:rt1900ac auto
SEQ(SP=FF-109%GCD=1-6%ISR=107-111%TI=Z%CI=RD%TS=A)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(R=N)

# Synology Disk Station - DS-101g+
Fingerprint Synology Disk Station DS-101g+ NAS
Class Synology | embedded || storage-misc
SEQ(SP=C5-CF%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=MF78ST11NW0%O2=MF78ST11NW0%O3=MF78NNT11NW0%O4=MF78ST11NW0%O5=MF78ST11NW0%O6=MF78ST11)
WIN(W1=2E44%W2=2E44%W3=2E44%W4=2E44%W5=2E44%W6=2E44)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2E68%O=MF78NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2E44%S=O%A=S+%F=AS%O=MF78ST11NW0%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Telekom Media Receiver 400
Fingerprint Deutsch Telekom MR 400 set-top box
Class T-Home | embedded || media device
SEQ(SP=100-10C%GCD=1-6%ISR=103-10D%TI=I%CI=Z%II=I%SS=S%TS=A)
OPS(O1=M5ACST11NW2%O2=M5ACST11NW2%O3=M5ACNNT11NW2%O4=M5ACST11NW2%O5=M5ACST11NW2%O6=M5ACST11)
WIN(W1=3840%W2=3840%W3=3840%W4=3840%W5=3840%W6=3840)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=38B8%O=M5ACNNSNW2%CC=Y%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Speedport W504V
Fingerprint T-Home Speedport W 504V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_504v
SEQ(SP=0-1D%GCD=1-6|64|C8|12C|190|1F4%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N|Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|S|Y%T=3B-45%TG=40%CD=Z)

# Speedport W 504V DSL Router + WAP
Fingerprint T-Home Speedport W 504V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_504v
SEQ(SP=0-1A%GCD=1-6|64|C8|12C|190|1F4%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=O|S%T=3B-45%TG=40%CD=Z)

# T-Home Speedport W 700V WAP
# T-Com Speedport w700V Router,ADSL-Modem,ADSL2-Modem,WAP
Fingerprint T-Home Speedport W 700V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_700v
SEQ(SP=0-5%GCD=68|6C|D0|D8|138|144|1A0|1B0|208|21C%ISR=4B-55%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|O|S|Y%T=3B-45%TG=40%CD=Z)

# Arcadyan Router W700V (Deutsche Telekom)
Fingerprint T-Home Speedport W 700V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_700v
SEQ(SP=18-22%GCD=1-6%ISR=4B-55%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N|S%T=3B-45%TG=40%CD=Z)

# Speedport W700V Integrated ADSL2 Modem
Fingerprint T-Home Speedport W 700V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_700v
SEQ(SP=0-5%GCD=65|CA|12F|194|1F9%ISR=4B-55%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N|Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=O|S%T=3B-45%TG=40%CD=Z)

# Speedport W 723V Typ B
Fingerprint T-Home Speedport W 723V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_723v
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4B-55%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=A000%W2=A000%W3=A000%W4=A000%W5=A000%W6=A000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=A000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=A000%S=O%A=O|S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N|Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Speedport W723V from Telekom Germany(T-Online)
Fingerprint T-Home Speedport W 723V WAP
Class T-Home | embedded || WAP
CPE cpe:/h:t-home:speedport_w_723v
SEQ(SP=0-1D%GCD=1-6|64|C8|12C|190|1F4%ISR=4B-55%TI=I%CI=I%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=7E99%RUD=G)
IE(R=N)

# VxWorks --Ed.
# BATM Advanced Communications, Switch model   : T-Marc-254H, SW version     : 10.1.R1 created Mar 31 2010 - 23:04:24, Loader version : 9.4.3 created Nov 10 2009 - 15:51:37
Fingerprint T-Marc 254H switch
Class T-Marc | embedded || switch
CPE cpe:/h:t-marc:254h auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Tadiran Coral Flexset 280s.
Fingerprint Tadiran FlexSet-IP 280S VoIP phone
Class Tadiran | embedded || VoIP phone
CPE cpe:/h:tadiran:flexset-ip_280s
SEQ(SP=F6-100%GCD=1-6%ISR=FB-105%TI=I%CI=I%II=I%SS=S%TS=U)
OPS()
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=N%T=37-41%TG=40%W=111C%CC=N)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=37-41%TG=40%IPL=150%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# Tahoe 8216 - Remote Power Management System. http://www.tahoe.pl/tahoe_8216.php
Fingerprint Tahoe 8216 power management system
Class Tahoe | embedded || power-device
CPE cpe:/h:tahoe:8216
SEQ(SP=9F-E9%GCD=3|6|9|C|F%ISR=A7-D3%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M240%O2=M240%O3=M240%O4=M240%O5=M218%O6=M109)
WIN(W1=C00%W2=C00%W3=C00%W4=C00%W5=C00%W6=C00)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=C00%O=M240%CC=N%Q=U)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=C00%S=O%A=S+%F=ASF%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=150%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=Z)

# Tandberg TT1222 satellite receiver
Fingerprint Tandberg TT 1122 video receiver
Class Tandberg | embedded || media device
CPE cpe:/h:tandberg:tt_1122
SEQ(SP=0-19%GCD=1-6|58|B0|108|160|1B8%ISR=49-53%TI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5DC%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=2000%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=1BD8|1E8F|216B|247B|27B6%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=27-40%TG=40%CD=S)

# Tandberg C60 running firmware versions TC4.0.1.240265
Fingerprint Tandberg Codec C60 video conferencing system
Class Tandberg | embedded || webcam
CPE cpe:/h:tandberg:codec_c60
SEQ(SP=100-10A%GCD=1-6%ISR=101-10B%TI=I%CI=Z%II=I%SS=O%TS=U)
OPS(O1=M5B4SLL%O2=M5B4SLL%O3=M5B4%O4=M5B4SLL%O5=M5B4SLL%O6=M5B4SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3C-46%TG=40%W=FFFF%O=M5B4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3C-46%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=A694%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# TANDBERG VCS Expressway Software version        X6.1
Fingerprint Tandberg VCS video conferencing system
Class Tandberg | embedded || webcam
CPE cpe:/h:tandberg:vcs
SEQ(SP=F3-107%GCD=1-6%ISR=FF-109%TI=Z%II=I%TS=A)
OPS(O1=M4B0ST11NW7%O2=M4B0ST11NW7%O3=M4B0NNT11NW7%O4=M4B0ST11NW7%O5=M4B0ST11NW7%O6=M4B0ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M4B0NNSNW7%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Tandberg Video Conference System
Fingerprint Tandberg Video Conference System
Class Tandberg | embedded || webcam
SEQ(SP=CA-D4%GCD=1-6%ISR=CC-D6%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=10F8%W2=10F8%W3=10F8%W4=10F8%W5=10F8%W6=10F8)
ECN(R=Y%DF=Y%T=39-43%TG=40%W=111C%O=M5B4NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=39-43%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=39-43%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=39-43%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=39-43%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=39-43%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=39-43%TG=40%CD=S)

# TANDBERG 990 MXP Video Conferencing Unit
# Tandberg T1000 [TTC7-02] integrated Video Conferencing Unit
# Tandberg Codec 2500, also known as: Tandberg 2500 Classic, Firmware=B10.3
# Tandberg T1000 portable video conference codec
Fingerprint Tandberg video conferencing system (1000, 2500, or 990 MXP)
Class Tandberg | embedded || webcam
CPE cpe:/h:tandberg:1000
CPE cpe:/h:tandberg:2500
CPE cpe:/h:tandberg:990_mxp
SEQ(SP=FD-109%GCD=1-6%ISR=101-111%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3E80%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3E80%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=ARF%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=RF%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=ARF%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Cisco/Codian MCU 4210, according to it's boot messages - NetBSD inside
Fingerprint Tandberg Codian videoconferencing system (NetBSD)
Class Tandberg | NetBSD || media device
CPE cpe:/o:tandberg:netbsd auto
SEQ(SP=CB-D9%GCD=1-6%ISR=D8-E2%TI=RD%CI=RI%TS=0)
OPS(O1=M5B4NW0NNT01%O2=M5B4NW0NNT01%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01%O5=M5B4NW0NNT01%O6=M5B4NNT01)
WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=8000%O=M5B4NW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Tandem Himalaya K2000, Guardian 90 (Operating System D30, Release D39.02)
Fingerprint Tandem Himalaya K2000 server (Guardian 90)
Class Tandem | Guardian || general purpose
CPE cpe:/o:tandem:guardian auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Technisat Digicoder HD S2, sat receiver
Fingerprint TechniSat Digicorder HD S2 satellite receiver
Class TechniSat | embedded || media device
CPE cpe:/h:technisat:digicorder_hd_s2
SEQ(SP=C5-D9%GCD=1-6%ISR=D7-E1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=6E-78%TG=80%W=2000%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=6E-78%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=6E-78%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6E-78%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6E-78%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6E-78%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6E-78%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=82A0%RUD=G)
IE(DFI=N%T=6E-78%TG=80%CD=Z)

# Tektronix Phaser 8200DP, firmware: OS 3.106 laser printer
Fingerprint Tektronix Phaser 8200DP printer
Class Tektronix | embedded || printer
CPE cpe:/h:tektronix:phaser_8200dp
SEQ(R=N)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=7A-84%TG=80%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=7A-84%TG=80%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7A-84%TG=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=7A-84%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7A-84%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7A-84%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7A-84%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7A-84%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7A-84%TG=80%CD=S)

Fingerprint Telco Systems T-Marc 250
Class Telco Systems | embedded || bridge
CPE cpe:/h:telco_systems:t-marc_250
SEQ(SP=F4-FE%GCD=1-6%ISR=FB-105%TI=I%CI=RD%II=I%SS=S%TS=1)
OPS(O1=M564NW0NNT11%O2=M564NW0NNT11%O3=M564NW0NNT11%O4=M564NW0NNT11%O5=M564NW0NNT11%O6=M564NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M564NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Teldat K Series Gateway. FTTH Movistar Spain
Fingerprint Teldat K series gateway
Class Teldat | embedded || broadband router
SEQ(SP=C-28%GCD=1-6%ISR=53-5D%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M109)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=36-40%TG=40%W=800%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=36-40%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=36-40%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=U)
T3(R=Y%DF=N%T=36-40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
T4(R=Y%DF=N%T=36-40%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=U)
T5(R=Y%DF=N%T=36-40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
T6(R=Y%DF=N%T=36-40%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=U)
T7(R=Y%DF=N%T=36-40%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=U)
U1(DF=N%T=36-40%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=36-40%TG=40%CD=Z)

# German Telekom DSL-Router:, Speedport W921V, Boot-Code-Version v1.09.01, Firmware-Version 1.24.000, Hardware-Version 01A
Fingerprint Telekom Speedport W921V wireless DSL modem
Class Telekom Deutschland | embedded || broadband router
SEQ(SP=1-4F%GCD=1-6%ISR=4B-55%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=F000%W2=F000%W3=F000%W4=F000%W5=F000%W6=F000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=F000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=F000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=O%T=3B-45%TG=40%CD=Z)

# Telekom T-Sinus 130 DSL Router
Fingerprint T-Sinus 130 DSL router
Class Telekom | embedded || broadband router
SEQ(SP=8A-9A%GCD=1-6%ISR=96-A0%TI=I%II=I%SS=O%TS=0)
OPS(O1=NNT11|M57ENW0NNT00NNS%O2=NNT11|M57ENW0NNT00NNS%O3=NNT11|M57ENW0NNT00%O4=NNT11|M57ENW0NNT00NNS%O5=NNT11|M57ENW0NNT00NNS%O6=)
WIN(W1=7FFF%W2=7FFF%W3=7FFF%W4=7FFF%W5=7FFF%W6=0)
ECN(R=Y%DF=N%T=3A-44%TG=40%W=0%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3A-44%TG=40%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=1AF8%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Arcadyan Technology Speedport W723 Typ B
Fingerprint Telekom Speedport W723V Typ B router
Class Telekom | embedded || broadband router
SEQ(SP=E-18%GCD=1-6%ISR=4B-55%TI=I%CI=I%TS=U)
OPS(O1=M5AC%O2=M578%O3=M280%O4=M5AC%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M5AC%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=O%T=3B-45%TG=40%CD=Z)

# Telewell TW-EA501 (version 1) ADSL modem/router, Firmware Version: 2.7.0.38(UE0.B1C)3.5.12.4, ADSL Firmware Version: FwVer:3.5.12.4_A_TC3084 HwVer:T14.F7_0.0
Fingerprint Telewell TW-EA501 ADSL modem
Class Telewell | embedded || broadband router
CPE cpe:/h:telewell:tw-ea501 auto
SEQ(SP=0-16%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=AF0%W2=AF0%W3=AF0%W4=AF0%W5=AF0%W6=AF0)
ECN(R=Y%DF=N%T=FE%TG=FF%W=AF0%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# TELEX IP-223  Radio over IP interface device
Fingerprint Telex IP-223 radio IP adapter
Class Telex | embedded || bridge
CPE cpe:/h:telex:ip-223
SEQ(SP=CE-D8%GCD=1-6%ISR=D4-DE%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=6C-76%TG=80%W=4000%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=6C-76%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=6C-76%TG=80%W=4000%S=O%A=S+%F=AS%O=M5B4W0L%RD=0%Q=)
T4(R=Y%DF=N%T=6C-76%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6C-76%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6C-76%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6C-76%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6C-76%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=2389%RUD=G)
IE(DFI=N%T=6C-76%TG=80%CD=Z)

# Telsey Videostation provided by an italian internet provider called Fastweb. It runs on a 2.4.19 linux kernel customized by Fastweb.
Fingerprint Telsey IP Video Station media server
Class Telsey | embedded || media device
CPE cpe:/h:telsey:ip_video_station
SEQ(SP=C-16%GCD=9C4|1388|1D4C|2710|30D4%ISR=5D-67%TI=I%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=578%W2=578%W3=578%W4=578%W5=578%W6=578)
ECN(R=Y%DF=N%T=20-36%TG=40%W=578%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=22-39%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=28-3C%TG=40%W=578%S=O%A=S+%F=AS%O=M578%RD=0%Q=)
T4(R=Y%DF=N%T=22-3B%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=21-3B%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=Y%DF=N%T=27-3E%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Teltronics NET-PATH <http://www.teltronics.com/products_services/ism/text.asp?id=SEBNETPATH> OS Version: 3.0.1.1047 Application Version: 3.1.1.1057
Fingerprint Teltronics NET-PATH intrusion detection system
Class Teltronics | embedded || firewall
CPE cpe:/h:teltronics:net-path
SEQ(SP=46-95%GCD=FA|1F4|2EE|3E8|4E2%ISR=8C-BA%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5A2%O2=M5A2%O3=M5A2%O4=M5A2%O5=M5A2%O6=M5A2)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=400%O=M5A2%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# iRMX III R2.2 (for MS-DOS)
Fingerprint TenAsys iRMX III 2.2
Class TenAsys | iRMX | 2.X | specialized
CPE cpe:/o:tenasys:irmx:2 auto
SEQ(R=N)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Tenda N301
Fingerprint Tenda N301 WAP
Class Tenda | embedded || WAP
CPE cpe:/h:tenda:n301 auto
SEQ(SP=F0-10C%GCD=1-6%ISR=107-111%TI=I%CI=I|RI%II=I%SS=S%TS=7)
OPS(O1=M5ACNW0NNT11%O2=M5ACNW0NNT11%O3=M5ACNW0NNT11%O4=M5ACNW0NNT11%O5=M5ACNW0NNT11%O6=M5ACNNT11)
WIN(W1=4380%W2=4110%W3=423C%W4=4380%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4410%O=M5ACNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# PCOIP Zero Client Firmware
Fingerprint Teradici PCoIP Zero Client remote management console
Class Teradici | embedded || remote management
SEQ(SP=EF-105%GCD=1-6%ISR=104-10E%TI=RI%CI=RI%TS=A)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=4988%W2=4BE8%W3=4998%W4=4988%W5=49B0%W6=4825)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4A24%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Teradici 10zig V-1200P firmware 5.4.1
Fingerprint Teradici 10ZiG V1200 thin client
Class Teradici | embedded || terminal
CPE cpe:/h:teradici:10zig_v1200 auto
SEQ(SP=103-10D%GCD=1-6%ISR=105-10F%TI=I%II=I%TS=A)
OPS(O1=M43ENW0NNSNNT11%O2=M43ENW0NNSNNT11%O3=M280NW0NNT11%O4=M43ENW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2190%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2238%O=M43ENW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Mitsubishi VFD
Fingerprint Mitsubishi VFD (Texas Instruments chipset)
Class Texas Instruments | embedded || specialized
SEQ(SP=0-5%GCD=2EE00|5DC00|8CA00|BB800|EA600%ISR=A2-AC%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Thales nCipher NetHSM 500 running firmware version 2.50.16
Fingerprint Thales nCipher NetHSM 500 hardware security module
Class Thales | embedded || security-misc
CPE cpe:/h:thales:ncipher_nethsm_500
SEQ(SP=FF-109%GCD=2|4|6|8|A%ISR=107-111%TI=RD%CI=RD%II=RI%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4000%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Thecus 4200 NAS, http://www.thecus.com/product.php?PROD_ID=30
# Thecus N5500 NAS System Linux n5500 2.6.33N7700 #5 SMP Wed Jan 26 12:14:33 CST 2011 i686 unknown
Fingerprint Thecus 4200 or N5500 NAS device (Linux 2.6.33)
Class Thecus | embedded || storage-misc
CPE cpe:/h:thecus:4200
CPE cpe:/h:thecus:n5500
SEQ(SP=C6-D0%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=|M5B4NNS%O2=|M5B4NNS%O3=|M5B4%O4=|M5B4NNS%O5=|M5B4NNS%O6=|M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=|M5B4NNS%CC=N|Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%S=O%A=O|S+%F=A|AS%O=|M5B4NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thecus N4100PRO running firmware version 5.01.00.8. Looks like OpenWrt --Ed.
Fingerprint Thecus N4100PRO NAS device
Class Thecus | embedded || storage-misc
CPE cpe:/h:thecus:n4100pro
SEQ(SP=BF-C9%GCD=1-6%ISR=C6-D0%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M1F18NNSNW6%O2=M1F18NNSNW6%O3=M1F18NW6%O4=M1F18NNSNW6%O5=M1F18NNSNW6%O6=M1F18NNS)
WIN(W1=3E30%W2=3E30%W3=3E30%W4=3E30%W5=3E30%W6=3E30)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3E30%O=M1F18NNSNW6%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3E30%S=O%A=S+%F=AS%O=M1F18NNSNW6%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thecus N5200 Pro NAS
Fingerprint Thecus N5200PRO NAS device
Class Thecus | embedded || storage-misc
CPE cpe:/h:thecus:n5200pro auto
SEQ(SP=AE-B8%GCD=1-6%ISR=B5-BF%TI=Z%CI=I%II=I%TS=8)
OPS(O1=M3E58ST11NW5%O2=M3E58ST11NW5%O3=M3E58NNT11NW5%O4=M3E58ST11NW5%O5=M3E58ST11NW5%O6=M3E58ST11)
WIN(W1=7C98%W2=7C98%W3=7C98%W4=7C98%W5=7C98%W6=7C98)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=7CB0%O=M3E58NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=7C98%S=O%A=S+%F=AS%O=M3E58ST11NW5%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thecus N8800PRO NAS running firmware version 5.02.02.
Fingerprint Thecus N8800PRO NAS device
Class Thecus | embedded || storage-misc
CPE cpe:/h:thecus:n8800pro auto
SEQ(SP=C2-CC%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4NNS%O2=M5B4NNS%O3=M5B4%O4=M5B4NNS%O5=M5B4NNS%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# SpeedTouch 510 SW-Version  : 4.2.7.16.0
Fingerprint Thomson SpeedTouch 510 DSL modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:speedtouch_510 auto
SEQ(SP=100-10A%GCD=1-6%ISR=102-10C%TI=I%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Thomson Speedtouch 510
Fingerprint Thomson SpeedTouch 510 DSL modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:speedtouch_510 auto
SEQ(SP=100-10A%GCD=1-6%ISR=106-110%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M200NW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Broadband Router; Thompson SpeedTouch 530
# Speedtouch 580
# Thomson Telecom Belgium Speedtouch 530
# Thomson SpeedTouch 510i
# SpeedTouch 510 ADSL modem/router Firmware version 4.2.7.16.0
# SpeedTouch 570, Version 4.2.1.9
Fingerprint Thomson SpeedTouch 510/510i/530/570/580 DSL modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:speedtouch_510
CPE cpe:/h:thomson:speedtouch_510i
CPE cpe:/h:thomson:speedtouch_530
CPE cpe:/h:thomson:speedtouch_570
CPE cpe:/h:thomson:speedtouch_580
SEQ(SP=FD-109%GCD=1-6%ISR=103-10F%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thomson (formerly called Speedtouch) ST536i. The firmware is common to models ST516, ST536 and ST546, and these models with "i" appended.
# Thomson ST SpeedTouch 585 v6
Fingerprint Thomson ST 585 or ST 536i ADSL modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:st_585
CPE cpe:/h:thomson:st_536i
SEQ(SP=102-10C%GCD=1-6%ISR=109-113%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=48%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thomson cable modem tcm390
Fingerprint Thomson TCM390 cable modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:tcm390 auto
SEQ(SP=7B-89%GCD=1-6%ISR=83-91%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Thomson TCW 710
Fingerprint Thomson TCW710 wireless cable modem
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:tcw710 auto
SEQ(SP=DF-101%GCD=1-6%ISR=E2-10A%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Thomson TG712 DSL router
Fingerprint Thomson TG712 DSL router
Class Thomson | embedded || broadband router
CPE cpe:/h:thomson:tg712 auto
SEQ(SP=102-10C%GCD=1-6%ISR=107-111%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=48%UN=0%RIPL=134%RID=G%RIPCK=I%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Thomson ST2030
# Thomson ST2030 VoIP Phone
Fingerprint Thomson ST 2030 VoIP phone
Class Thomson | embedded || VoIP phone
CPE cpe:/h:thomson:st_2030 auto
SEQ(SP=F3-10D%GCD=1-6%ISR=FB-113%TI=I%II=I%SS=S%TS=9)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Thomson Symbio phone.
Fingerprint Thomson Symbio VoIP phone
Class Thomson | embedded || VoIP phone
SEQ(SP=BD-C7%GCD=1-6%ISR=C3-CD%TI=Z%TS=8)
OPS(O1=M5ACST11NW1%O2=M5ACST11NW1%O3=M5ACNNT11NW1%O4=M5ACST11NW1%O5=M5ACST11NW1%O6=M5ACST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5ACNNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=D563%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Tiandy NVR (rebranded?)
Fingerprint Tiandy NVR
Class Tiandy | embedded || media device
SEQ(SP=101-10B%GCD=1-6%ISR=105-10F%TI=Z%TS=U)
OPS(O1=M5B4NW5%O2=M5B4NW5%O3=M5B4NW5%O4=M5B4NW5%O5=M5B4NW5%O6=M5B4)
WIN(W1=3908%W2=3908%W3=3908%W4=3908%W5=3908%W6=3908)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Vendor: Tibbo (www.tibbo.com), Model: DS1xxx, Firmware: <V3.34(S)>+N
Fingerprint Tibbo DS10xx serial controller, V3.34
Class Tibbo | embedded || specialized
SEQ(SP=8C-96%GCD=1-6%ISR=97-A1%TI=I%CI=I%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=FF%W2=FF%W3=FF%W4=FF%W5=FF%W6=FF)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=FF%O=%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=FA-104%TG=FF%W=80%S=A%A=O%F=R%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=FF%S=O%A=S+%F=AS%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=400%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7A69%S=A%A=O%F=R%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=8000%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=A%A=O%F=R%O=%RD=0%Q=)
U1(R=N)
IE(R=N)

# Tigo Energy Cloud Connect (Looks like Linux --ed.)
Fingerprint Tigo Energy Cloud Connect solar power gateway
Class Tigo Energy | embedded || power-device
SEQ(SP=FC-106%GCD=1-6%ISR=105-10F%TI=Z%CI=I%TS=7)
OPS(O1=M4D8ST11NW5%O2=M4D8ST11NW5%O3=M4D8NNT11NW5%O4=M4D8ST11NW5%O5=M4D8ST11NW5%O6=M4D8ST11)
WIN(W1=5FF0%W2=5FF0%W3=5FF0%W4=5FF0%W5=5FF0%W6=5FF0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=60E0%O=M4D8NNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# TODO: update or remove this when we get better Tizen version info
# Tizen on Samsung Gear Fit 2
Fingerprint Tizen
Class Tizen | Tizen || specialized
CPE cpe:/o:tizen:tizen auto
SEQ(SP=FB-105%GCD=1-6%ISR=105-10F%TI=Z%CI=Z%TS=1)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Topfield TF6000PVR ES (Satellite based digital video recorder)
# Topfield TF600PVRc
# Topfield TF600PVR
Fingerprint Topfield TF6000PVR set top box
Class Topfield | embedded || media device
CPE cpe:/h:topfield:tf6000pvr
SEQ(SP=0-5F%GCD=1-6|7FC|FF8|17F4|1FF0|27EC%ISR=56-94%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=4E20%W2=4E20%W3=4E20%W4=4E20%W5=4E20%W6=4E20)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=4E20%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=20-3F%TG=40%CD=S)

# QNX TMS5 (Terminal Management System 5) System from Toptech Systems, Inc.
Fingerprint Toptech TMS5 terminal management
Class Toptech | embedded || terminal server
CPE cpe:/h:toptech:tms5
SEQ(SP=EF-F9%GCD=2|4|6|8|A%ISR=FC-106%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=1F0E)
ECN(R=Y%DF=N%T=38-42%TG=40%W=2000%O=M200%CC=N)
T1(R=Y%DF=N%T=38-42%TG=40%S=O%A=O|S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=38-42%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=F8-102%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=F8-102%TG=FF%CD=S)

# Toshiba 4690 OS Version 6
Fingerprint Toshiba 4690 OS point-of-sale system
Class Toshiba | 4690 OS | 6.X | specialized
CPE cpe:/o:toshiba:4690_operating_system:6
SEQ(SP=C-16%GCD=600|C00|1200|1800|1E00%ISR=6C-76%TI=I%CI=Z%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=7000%W2=7000%W3=7000%W4=7000%W5=7000%W6=7000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=7000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=7000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=7000%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Toshiba Digital television set (REGZA series)
Fingerprint Toshiba REGZA TV
Class Toshiba | embedded || media device
CPE cpe:/h:toshiba:regza
SEQ(SP=BE-C8%GCD=1-6%ISR=C4-CE%TI=Z%II=I%TS=A|C)
OPS(O1=NNT11|M5B4ST11NW1%O2=NNT11|M5B4ST11NW1%O3=NNT11|M5B4NNT11NW1%O4=NNT11|M5B4ST11NW1%O5=NNT11|M5B4ST11NW1%O6=NNT11|M5B4ST11)
WIN(W1=10F8%W2=10F8%W3=10F8%W4=10F8%W5=10F8%W6=10F8)
ECN(R=Y%DF=Y%T=3B-45|7B-85%TG=40|80%W=111C%O=|M5B4NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45|7B-85%TG=40|80%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45|7B-85%TG=40|80%W=10F8%S=O%A=O|S+%F=A|AS%O=NNT11|M5B4ST11NW1%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Toshiba e-Studio20 printer, ROM Version 6.19 TA
Fingerprint Toshiba e-STUDIO 20 printer
Class Toshiba | embedded || printer
CPE cpe:/h:toshibatec:e-studio-20
SEQ(R=N)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-3D%TG=40%W=1000%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=3B-3D%TG=40%S=Z%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-3D%TG=40%W=1000%S=Z%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-3D%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-3D%TG=40%CD=S)

# Toshiba e-STUDIO280 (network copier/printer)
Fingerprint Toshiba e-STUDIO 280 printer
Class Toshiba | embedded || printer
CPE cpe:/h:toshibatec:e-studio-280
SEQ(SP=CB-13B%GCD=1-6%ISR=D7-11D%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M200%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=71-7B%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=71-7B%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=71-7B%TG=80%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=71-7B%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=71-7B%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=71-7B%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=71-7B%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=71-7B%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=2A39%RUD=G)
IE(DFI=N%T=71-7B%TG=80%CD=Z)

# TOSHIBA e-STUDIO 4511
Fingerprint Toshiba e-STUDIO 4511 printer
Class Toshiba | embedded || printer
CPE cpe:/h:toshibatec:e-studio-4511
SEQ(SP=C9-135%GCD=1-6%ISR=D6-120%TI=I%II=I%SS=O|S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M200%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=72-7C%TG=80%W=2000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=72-7C%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=72-7C%TG=80%W=2000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=72-7C%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=72-7C%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=72-7C%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=72-7C%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=72-7C%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=84B7%RUD=G)
IE(DFI=N%T=72-7C%TG=80%CD=Z)

# TL-R4239G
Fingerprint TP-LINK TL-R4239G router
Class TP-LINK | embedded || broadband router
CPE cpe:/h:tp-link:tl-r4239g auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%TS=U)
OPS(O1=NNM564SNW0%O2=NNM564SNW0%O3=M564NW0%O4=NNM564SNW0%O5=NNM564SNW0%O6=NNM564S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM564SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# TP-Link R470T 3 Wan Ports
Fingerprint TP-LINK TL-R470T router
Class TP-LINK | embedded || broadband router
CPE cpe:/h:tp-link:tl-r470t auto
SEQ(SP=85-8F%GCD=1-6%ISR=96-A0%TI=I%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# TL-R478+
Fingerprint TP-LINK TL-R478+ router
Class TP-Link | embedded || broadband router
CPE cpe:/h:tp-link:tl-r478+
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%II=I%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# TP-LINK TL-480T+
Fingerprint TP-LINK TL-R480T+
Class TP-LINK | embedded || broadband router
CPE cpe:/h:tp-link:tl-r480t+
SEQ(SP=5C-66%GCD=1-6%ISR=95-9F%TI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# TP-LINK print server
Fingerprint TP-LINK PS110U print server
Class TP-LINK | embedded || print server
CPE cpe:/h:tp-link:ps110u auto
SEQ(SP=16-20%GCD=1-6%ISR=76-80%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=>0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=21-3F%TG=40%CD=S)

# TP-LINK TL-PS110U print server
Fingerprint TP-LINK TL-PS110U or TL-WPS4510U print server
Class TP-LINK | embedded || print server
SEQ(SP=31-45%GCD=1-6%ISR=80-96%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=27-3C%TG=40%CD=S)

# TL-PS110U Network Print Server Firmware Version: 9.08.47T 0016  (2010/03/22 17:47:37)
Fingerprint TP-LINK TL-PS110U print server
Class TP-LINK | embedded || print server
CPE cpe:/h:tp-link:tl-ps110u auto
SEQ(SP=13-3B%GCD=1-6%ISR=68-72%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=2800%W2=2800%W3=2800%W4=2800%W5=2800%W6=2800)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%O=M5B4%CC=N)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%S=O%A=S+%F=AS%O=M109%RD=0)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%S=A+%A=S%F=AR%RD=0)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=2800%S=A%A=S+%F=AR%RD=0)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=2B-3F%TG=40%CD=S)

# TL-PS110U
Fingerprint TP-LINK TL-PS110U print server
Class TP-LINK | embedded || print server
CPE cpe:/h:tp-link:tl-ps110u auto
SEQ(SP=3E-6E%GCD=1-6%ISR=D3-DD%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=111C%W2=111C%W3=111C%W4=111C%W5=111C%W6=111C)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=111C%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=2B46|5BAE|8C36|BCDF|FAFE%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=23-40%TG=40%CD=S)

# TP-LINK TL-WPS510U single-port print server
Fingerprint TP-LINK TL-WPS510U print server
Class TP-LINK | embedded || print server
CPE cpe:/h:tp-link:tl-wps510u auto
SEQ(SP=0-52%GCD=1-6|C19E|C1AA|1833C|18354|244DA|244FE|30678|306A8|3C816|3C852%ISR=92-9C%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%O=M5B4%CC=N)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%RD=0)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=R%RD=0)
T7(R=N)
U1(DF=N%T=1B-25%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=1B-25%TG=20%CD=S)

#  EAP330, kernel version 2.6.36
Fingerprint TP-LINK EAP330 WAP (Linux 2.6.36)
Class TP-LINK | embedded || WAP
CPE cpe:/h:tp-link:eap330 auto
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.36 auto
SEQ(SP=CB-D5%GCD=1-6%ISR=CD-D7%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW4%O2=M5B4ST11NW4%O3=M5B4NNT11NW4%O4=M5B4ST11NW4%O5=M5B4ST11NW4%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW4%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# TP-LINK 150Mbps Wireless N ADSL2+ Modem Router, Firmware Version: 4.0.0 Build 120207 Rel.10587
Fingerprint TP-LINK TD-W8951ND wireless ADSL modem
Class TP-LINK | embedded || WAP
CPE cpe:/h:tp-link:td-w8951nd auto
SEQ(SP=C-16%GCD=A000|14000|1E000|28000|32000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=AF0%W2=AF0%W3=AF0%W4=AF0%W5=AF0%W6=AF0)
ECN(R=Y%DF=N%T=F9-103%TG=FF%W=AF0%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# TP-LINK TL-WA5210G 2.4 GHz high Power Wireless Outdoor CPE, Firmware Version: 4.4.3 Build 100510 Rel.33448n [VxWorks? --Ed.]
Fingerprint TP-LINK TL-WA5210G WAP
Class TP-LINK | embedded || WAP
CPE cpe:/h:tp-link:tl-wa5210g auto
SEQ(SP=97-A1%GCD=1-6%ISR=9C-A6%TI=I%CI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(R=N)

# TL-WA801ND
Fingerprint TP-LINK TL-WA801ND WAP (Linux 2.6.36)
Class TP-LINK | embedded || WAP
CPE cpe:/h:tp-link:tl-wa801nd auto
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.36 auto
SEQ(SP=C0-CA%GCD=1-6%ISR=C1-CB%TI=Z%II=I%TS=8)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=N)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Tracer SC, Trane Building Automation System Controller (Linux 2.4? -- Ed.)
Fingerprint Trane Tracer SC building controller
Class Trane | embedded || specialized
CPE cpe:/h:trane:tracer_sc
SEQ(SP=C4-CE%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=8|A)
OPS(O1=M582ST11NW4%O2=M582ST11NW4%O3=M582NNT11NW4%O4=M582ST11NW4%O5=M582ST11NW4%O6=M582ST11)
WIN(W1=15D8%W2=15D8%W3=15D8%W4=15D8%W5=15D8%W6=15D8)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1608%O=M582NNSNW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=15D8%S=O%A=S+%F=AS%O=M582ST11NW4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ithaca 280 (Looks like lwIP --ed.)
Fingerprint TransAct Ithaca 280 thermal printer
Class TransAct | embedded || printer
CPE cpe:/h:transact:ithaca_280
SEQ(SP=4A-56%GCD=1-6%ISR=AE-B8%TI=I%CI=I%II=RI%SS=O%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=800%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=800%S=O%A=S+%F=AS%O=M400%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=800%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=800%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=800%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=800%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Trendware Broadband Router TW100-BRF114, Version 2.0 Release 04
Fingerprint TRENDnet TW100-BRF114 broadband router
Class TRENDnet | embedded || broadband router
CPE cpe:/h:trendnet:tw100-brf114 auto
SEQ(SP=0-5%GCD=80|100|180|200|280%ISR=4D-57%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M564%O3=M5B4%O4=M5B4%O5=M204%O6=MF5)
WIN(W1=C00%W2=C00%W3=C00%W4=C00%W5=C00%W6=C00)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=C00%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=C00%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=ECA7%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# TRENDnet TV-IP100 Internet camera
Fingerprint TRENDnet TV-IP100 webcam
Class TRENDnet | embedded || webcam
CPE cpe:/h:trendnet:tv-ip100 auto
SEQ(SP=C-16%GCD=37|6E|A5|DC|113%ISR=4B-55%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16D0%S=O%A=S+%F=ASF%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=FA-104%TG=FF%CD=Z)

# TRIPP LITE SMART1500SLT, Firmware Version: 12.04.0045
# TRIPP LITE SMART1500SLT with network card.
# TrippLite model:PDUMV30HVNET
# TRIPP LITE Model: PDUMH15AT
Fingerprint Tripp Lite SMART1500SLT UPS, or PDUMV30HVNET or PDUMH15AT power distribution unit
Class Tripp Lite | embedded || power-device
CPE cpe:/h:tripplite:smart1500slt
CPE cpe:/h:tripplite:pdumv30hvnet
SEQ(SP=CC-F4%GCD=1-6%ISR=D5-E7%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=74-7E%TG=80%W=4000%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=74-7E%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=74-7E%TG=80%W=4000%S=O%A=S+%F=AS%O=M5B4W0L%RD=0%Q=)
T4(R=Y%DF=N%T=74-7E%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=74-7E%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=74-7E%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=74-7E%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=74-7E%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUD=G)
IE(DFI=N%T=74-7E%TG=80%CD=Z)

# Tripp Lite UPS SMART3000RMXL2U
Fingerprint Tripp Lite SMART3000RMXL2U UPS
Class Tripp Lite | embedded || power-device
CPE cpe:/h:tripplite:smart3000rmxl2u
SEQ(SP=8C-96%GCD=1-6%ISR=98-A2%TI=I|RD%II=I%TS=A|B)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=43E0%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# PowerAlert 12.06.0061, NetOS 7.5.2tl
Fingerprint Tripp Lite NetOS 7.5.2tl
Class Tripp Lite | NetOS | 7.X | specialized
CPE cpe:/o:tripplite:netos:7.5.2tl auto
SEQ(CI=RD)
OPS(O1=M564NW0NNSNNT11%O2=M564NW0NNSNNT11%O3=M280NW0NNT11%O4=M564NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=4020%W2=4020%W3=423C%W4=43E0%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=40B0%O=M564NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FD-107%TG=FF%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FD-107%TG=FF%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FD-107%TG=FF%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FD-107%TG=FF%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FD-107%TG=FF%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# TUT Systems SMS2000
Fingerprint Tut Systems SMS2000 subscriber management system
Class Tut Systems | embedded || router
CPE cpe:/h:tutsystems:sms2000
SEQ(SP=FD-107%GCD=1-6%ISR=10A-114%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=7FE0%W2=7FE0%W3=7FE0%W4=7FE0%W5=7FE0%W6=7FE0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=7FE0%O=M5B4%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45|FA-104%TG=40|FF%W=0|7FE0%S=O|Z%A=O|S+%F=AR|ASF%O=|M109%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=2466%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Tyco Electronics 10/100/1000Mbps Ethernet Switch The documentation: http://sufni.kapitany.tk/manual/24_port_snmp_managed_switch_issue1.pdf
Fingerprint Tyco 24 Port SNMP Managed Switch
Class Tyco | embedded || switch
SEQ(SP=0-1D%GCD=0|3D090|7A120|B71B0|F4240|1312D0%ISR=0-129%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=400%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=400%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Ubee EVW3226 DOCSIS 3.0 Cable modem CPE device., Software version: EVW3226_1.0.13
Fingerprint Ubee EVW3226 cable modem
Class Ubee | embedded || WAP
CPE cpe:/h:ubee:evw3226 auto
SEQ(SP=BC-D0%GCD=1-6%ISR=CA-D4%TI=I%CI=Z%II=I%SS=S%TS=7)
OPS(O1=M5B4ST11NW4%O2=M5B4ST11NW4%O3=M5B4NNT11NW4%O4=M5B4ST11NW4%O5=M5B4ST11NW4%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3908%O=M5B4NNSNW4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# EVW3226 Router Device scanned from outside with "Port Scan Detection" activated
# Arris Touchstone DG1672
# Arris cable modem/router/Wireless AP/switch with VOIP, 2.6.18_pro500
# Ubee EVW3226, HW:1.23 SW:1.0.13
Fingerprint Ubee EVW3226 or Arris TG1672 or TG862G cable modem (Linux 2.6.18)
Class Ubee | embedded || WAP
CPE cpe:/h:ubee:evw3226 auto
Class Arris | embedded || WAP
CPE cpe:/h:arris:tg1672
CPE cpe:/h:arris:tg862g
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.18
SEQ(SP=C4-D0%GCD=1-6%ISR=CB-D9%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW4%O2=M5B4ST11NW4%O3=M5B4NNT11NW4%O4=M5B4ST11NW4%O5=M5B4ST11NW4%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ubicom ipOS (IP3023 network processor).
Fingerprint Ubicom ipOS
Class Ubicom | ipOS || specialized
CPE cpe:/o:ubicom:ipos auto
SEQ(SP=9E-AE%GCD=1-6%ISR=AE-BC%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=10%W2=10%W3=10%W4=10%W5=10%W6=10)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=10%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=10%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# XW.v5.5.9 Build Number: 21734
Fingerprint Ubiquiti AirOS 5.5.9
Class Ubiquiti | AirOS | 5.X | WAP
CPE cpe:/o:ubnt:airos:5.5.9 auto
SEQ(SP=101-10B%GCD=1-6%ISR=108-112%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M55CST11NW1%O2=M55CST11NW1%O3=M55CNNT11NW1%O4=M55CST11NW1%O5=M55CST11NW1%O6=M55CST11)
WIN(W1=1650%W2=1650%W3=1650%W4=1650%W5=1650%W6=1650)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1680%O=M55CNNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# XW.ar934x.v5.5.9.21734.140403.1801
Fingerprint Ubiquiti AirOS 5.5.9
Class Ubiquiti | AirOS | 5.X | WAP
CPE cpe:/o:ubnt:airos:5.5.9 auto
SEQ(SP=102-10C%GCD=1-6%ISR=107-111%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4ST11%O2=M5B4%O3=M5B4NNT11%O4=M5B4ST11%O5=M5B4ST11%O6=M5B4ST11)
WIN(W1=16A0%W2=16D0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNS%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ubiquity Picostation M2, Firmware Version:       XM.v5.6.2
Fingerprint Ubiquiti AirOS 5.6.2 (Linux 2.6.32)
Class Ubiquiti | AirOS | 5.X | WAP
CPE cpe:/o:ubnt:airos:5.6.2
Class Linux | Linux | 2.6.X | WAP
CPE cpe:/o:linux:linux_kernel:2.6.32
SEQ(SP=103-10D%GCD=1-6%ISR=106-110%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ubiquiti Pico Station Running AirOS latest version 5.2.6.9
Fingerprint Ubiquiti Pico Station WAP (AirOS 5.2.6)
Class Ubiquiti | AirOS | 5.X | WAP
CPE cpe:/o:ubnt:airos:5.2.6 auto
SEQ(SP=103-10D%GCD=1-6%ISR=104-10E%TI=Z%CI=Z%TS=A)
OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B4ST11NW1%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW1%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Edgemax POE Router Firmware 1.7: Linux 3.10.20-UBNT (root@ubnt-builder2) (gcc version 4.7.0 (Cavium Inc. Version: SDK_3_1_0_p2 build 34) ) #1 SMP Tue Jun 16 12:05:05 P
Fingerprint Ubiquiti Edgemax router firmware 1.7.0 (Linux 3.10)
Class Ubiquiti | embedded || router
Class Linux | Linux | 3.X | router
CPE cpe:/o:linux:linux_kernel:3.10 auto
SEQ(SP=F4-FE%GCD=1-6%ISR=102-10C%TI=Z%CI=I%II=I%TS=7)
OPS(O1=M2300ST11NW6%O2=M2300ST11NW6%O3=M2300NNT11NW6%O4=M2300ST11NW6%O5=M2300ST11NW6%O6=M2300ST11)
WIN(W1=45E8%W2=45E8%W3=45E8%W4=45E8%W5=45E8%W6=45E8)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4600%O=M2300NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# EdgeSwitch 48-Port 500W, v1.0.0.4664592, Linux 3.6.5-f4a26ed5
Fingerprint Ubiquiti EdgeSwitch (Linux 3.6)
Class Ubiquiti | embedded || switch
CPE cpe:/h:ubnt:edgeswitch
Class Linux | Linux | 3.X | general purpose
CPE cpe:/o:linux:linux_kernel:3.6 auto
SEQ(SP=F8-102%GCD=1-6%ISR=FC-106%TI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW0%O2=M5B4ST11NW0%O3=M5B4NNT11NW0%O4=M5B4ST11NW0%O5=M5B4ST11NW0%O6=M5B4ST11)
WIN(W1=B50%W2=B50%W3=B50%W4=B50%W5=B50%W6=B50)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=B68%O=M5B4NNSNW0%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# UAP-AC 3.2.12.2920
# UAP-AC v2
Fingerprint Ubiquiti UniFi AP-AC WAP (Linux 2.6.22)
Class Ubiquiti | embedded || WAP
CPE cpe:/h:ubnt:uap-ac
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.22 auto
SEQ(SP=C0-D8%GCD=1-6%ISR=EA-F4%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Ubiquiti webcam: Linux version 2.6.38.8 (sa_jenkins@sj-vid-build01) (gcc version 4.7.3 (OpenWrt/Linaro GCC 4.7-2013.03 unknown) ) #1 PREEMPT Thu Jun 25 23:09:31 UTC 2015
Fingerprint Ubiquiti webcam (Linux 2.6.38)
Class Ubiquiti | embedded || webcam
Class Linux | Linux | 2.6.X | webcam
CPE cpe:/o:linux:linux_kernel:2.6.38 auto
SEQ(SP=CB-D5%GCD=2|4|6|8|A%ISR=C8-D2%TI=Z%CI=Z%TS=7)
OPS(O1=M5B4ST11NW3%O2=M5B4ST11NW3%O3=M5B4NNT11NW3%O4=M5B4ST11NW3%O5=M5B4ST11NW3%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW3%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW3%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Universal Devices: Model: ISY 99i 1024 IR. Platform: ISY-C-99. Version: 3.2.5. http://www.universal-devices.com/99i.htm
Fingerprint Universal Devices ISY-99i IR receiver
Class Universal Devices | embedded || media device
CPE cpe:/h:universaldevices:isy-99i
SEQ(SP=66-70%GCD=1-6%ISR=9E-A8%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4SNL%O2=M5B4SNL%O3=M5B4SNL%O4=M5B4SNL%O5=M5B4SNL%O6=M5B4SNL)
WIN(W1=81D6%W2=81D5%W3=81D4%W4=81D3%W5=81D2%W6=81D1)
ECN(R=Y%DF=N%T=37-41%TG=40%W=81D6%O=M5B4SNL%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=R%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=81D6%S=O%A=S+%F=AS%O=M5B4SNL%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=R%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=37-41%TG=40%CD=S)

# Universal Devices ISY 994i home automation controler, Model: ISY 994i 1024 IR, Platform: ISY-C-994, Version: 4.0.5
Fingerprint Universal Devices ISY-99i IR receiver
Class Universal Devices | embedded || media device
SEQ(SP=66-70%GCD=1-6%ISR=9D-A7%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4SNL%O2=M5B4SNL%O3=M5B4SNL%O4=M5B4SNL%O5=M5B4SNL%O6=M5B4SNL)
WIN(W1=1224%W2=1224%W3=1224%W4=1224%W5=1224%W6=1224)
ECN(R=Y%DF=N%T=37-41%TG=40%W=1224%O=M5B4SNL%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=R%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=1224%S=O%A=S+%F=AS%O=M5B4SNL%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=R%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=37-41%TG=40%CD=S)

# USRobotics USR8000 broadband router, Firmware Version 1.25 German
Fingerprint USRobotics USR8000 broadband router
Class USRobotics | embedded || router
CPE cpe:/h:usrobotics:usr8000 auto
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4A-54%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Firmware version: R1.95j, Model Number: USR998000
Fingerprint USRobotics USR8000 broadband router
Class USRobotics | embedded || router
CPE cpe:/h:usrobotics:usr8000 auto
SEQ(SP=0-5%GCD=64|C8|12C|190|1F4%ISR=4B-55%TI=BI%II=BI%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=860%W2=860%W3=860%W4=860%W5=860%W6=860)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# USR5450 access point
Fingerprint USRobotics USR5450 WAP
Class USRobotics | embedded || WAP
CPE cpe:/h:usrobotics:usr5450 auto
SEQ(SP=B9-C3%GCD=1-6%ISR=C1-CB%TI=Z%II=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=41%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=7A-84%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7A-84%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7A-84%TG=80%CD=S)

# it was my DATAONE WA3002G4 router BSNL INDIA
Fingerprint UTStarcom WA3002G4 router
Class UTStarcom | embedded || broadband router
CPE cpe:/h:utstarcom:wa3002g4 auto
SEQ(SP=CF-D9%GCD=1-6%ISR=D8-E2%TI=I%CI=I%II=RI%SS=S%TS=1)
OPS(O1=M578NW0NNT11%O2=M578NW0NNT11%O3=M578NW0NNT11%O4=M578NW0NNT11%O5=M578NW0NNT11%O6=M578NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M578NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=507%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# vantage digital 7100s satellite decoder with software version 2.44.
Fingerprint Vantage HD7100S satellite receiver
Class Vantage | embedded || media device
CPE cpe:/h:vantage:hd7100s
SEQ(SP=C-16%GCD=7D00|FA00|17700|1F400|27100%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=16D0%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# System Description VBrick Systems Inc., Model 4300. This is a network based video encoder.
Fingerprint VBrick 4300 video encoder
Class VBrick | embedded || media device
CPE cpe:/h:vbrick:4300
SEQ(SP=97-A1%GCD=1-6%ISR=9D-A7%II=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Hardware Platform  : Vega 400  H323 Firmware Rev 08.00 for H/W Type 10
Fingerprint Vegastream Vega 400 VoIP Gateway
Class Vegastream | embedded || VoIP adapter
CPE cpe:/h:vegastream:vega_400 auto
SEQ(SP=E7-103%GCD=1-6%ISR=106-110%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3E80%W2=3E80%W3=3E80%W4=3E80%W5=3E80%W6=3E80)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3E80%O=|M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3E80%S=O%A=O|S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Viasat Surfbeam 2+  aka SB2Plus, running a modified linux firmware
Fingerprint Viasat SurfBeam 2 satellite modem
Class Viasat | embedded || broadband router
CPE cpe:/h:viasat:surfbeam_2
SEQ(SP=FE-108%GCD=1-6%ISR=105-10F%TI=Z%CI=RD%II=I%TS=7)
OPS(O1=M576ST11NW7%O2=M576ST11NW7%O3=M576NNT11NW7%O4=M576ST11NW7%O5=M576ST11NW7%O6=M576ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M576NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# VIPA device model 014-CEF0R00
# VIPA CPU 31X-4PN12 PN IO Controller
# Looks like VxWorks --Ed.
Fingerprint VIPA PLC CPU
Class VIPA | embedded || specialized
SEQ(SP=E5-101%GCD=1-6%ISR=F3-103%TI=I%CI=I%II=I%TS=C)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y|N%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# fingerprint identification device VIRDI 3000 Virditech Co.
Fingerprint Virdi 3000 fingerprint access controller
Class Virdi | embedded || security-misc
CPE cpe:/h:virdi:3000
SEQ(SP=0-5%GCD=64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=A)
OPS(O1=M5B4T11W0LLL%O2=M5B4T11W0LLL%O3=M5B4T11W0LLL%O4=M5B4T11W0LLL%O5=M5B4T11W0LLL%O6=M5B4T11W0LLL)
WIN(W1=1FFE%W2=1FFE%W3=1FFE%W4=1FFE%W5=1FFE%W6=1FFE)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=1FFE%O=M5B4T10W0LLL%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=7B-85%TG=80%W=1FFE%S=O%A=O|S+%F=AS%O=M5B4T11W0LLL%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Visual UpTime Select IP Transport DS3/E3 Inline ASE Software version:     I 3.1.011 - May 10 2009
Fingerprint Visual Network Systems Visual UpTime Select IP Transport DS3/E3 inline ASE
Class Visual Network Systems | embedded || specialized
SEQ(CI=I%II=I)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1%W2=3F%W3=4%W4=4%W5=10%W6=200)
ECN(R=Y%DF=N%T=26-35%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=29-37%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=Y%T=20-3B%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=25-36%TG=40%W=100%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=20-30|33-3F%TG=40%W=400%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=27-3D%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=20-2C|2E-3B%TG=40%W=8000%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1F-33|35-3F%TG=20|40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Visual UpTime Select IP Transport NxT1 Inline ASE Software version:     I 3.1.011 - May 10 2009
Fingerprint Visual Network Systems Visual UpTime Select IP Transport NxT1 inline ASE
Class Visual Network Systems | embedded || specialized
SEQ(SP=FA-106%GCD=1-6%ISR=100-10E%TI=I%CI=I%II=I%SS=O%TS=U)
OPS(O1=M564%O2=M564%O3=M564%O4=M564%O5=M564%O6=M564)
WIN(W1=7FF%W2=7FF%W3=7FF%W4=7FF%W5=7FF%W6=7FF)
ECN(R=Y%DF=N%T=19-2D%TG=20%W=FFFF%O=|M564%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=22-34%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=19-30%TG=20|40%W=100|7FE%S=O|Z%A=O%F=AR|AS%O=|M564%RD=0%Q=)
T4(R=Y%DF=Y%T=21-3C%TG=40%W=400%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=22-36%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=20-3E%TG=40%W=8000%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=26-40%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# Visual UpTime Select IP Transport T1 CSU DROP & INSERT ASE Software version:     I 3.1.011 - May 10 2009
Fingerprint Visual Network Systems Visual UpTime Select IP Transport T1 CSU DROP & INSERT ASE
Class Visual Network Systems | embedded || specialized
SEQ(CI=I%II=I)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1%W2=3F%W3=4%W4=4%W5=10%W6=200)
ECN(R=Y%DF=N%T=20-39%TG=40%W=3%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=27-39%TG=40%S=Z%A=S+%F=AR%RD=0%Q=)
T2(R=Y%DF=Y%T=28-3F%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=25-3F%TG=40%W=100%S=Z%A=O%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=20-3E%TG=40%W=400%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=23-3F%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=21-3D%TG=40%W=8000%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=25-3D%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=19-23%TG=20%IPL=38%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=19-23%TG=20%CD=S)

# VMware ESX 3.0.1 vmkernel ip stack
# VMWARE ESX-Server 3.0.1 (VMotion Interface)
# VMWare ESX Server,3.0.1,42829 (VMKernel Port)
# VMWare ESX 3.5 entreprise server, "vmotion" IP address
# ESX Server 3i Update 2 build 110271
# ESXi Server 3.5.0u2-110271
# ESX 3.5.0 v120505
# ESXi 3.5 Update 4
# VMKernel for ESX 3.5.0 build 110268
Fingerprint VMware ESX Server 3.0.0 - 3.5.0
Class VMware | ESX Server | 3.X | specialized
CPE cpe:/o:vmware:esx:3
SEQ(SP=F0-108%GCD=1-6%ISR=FF-111%TI=Z%II=RI%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESX Server 3.0.2 (default firewall configuration)
Fingerprint VMware ESX Server 3.0.2
Class VMware | ESX Server | 3.X | specialized
CPE cpe:/o:vmware:esx:3.0:2
SEQ(SP=FD-107%GCD=1-6%ISR=105-113%TI=Z%II=I%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# VMWare ESXi, Update 3 (embedded version of VMWare ESX)
# VMWare ESX version 3.5.0 (build 64607), Linux 2.4.21-47.0.1.ELvmnix #1 Thu Nov 29 17:50:29 PST 2007 i686 i686 i386 GNU/Linux
# VMware ESXi 3.5 Installable Update 3, Version: 3.5 Update 3 | 2008/11/06 | Build: 123629
# ESXi 3.5 U2
# ESX server 3i 3.5.0 build-123629 2008-10-15 21:03:57.000
Fingerprint VMware ESX Server 3.5.0
Class VMware | ESX Server | 3.X | specialized
CPE cpe:/o:vmware:esx:3.5
SEQ(SP=F4-10C%GCD=1-6%ISR=100-111%TI=Z%II=RI%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=O|S+%F=AS%O=M5B4NW1NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESX 4.0.1 vkernel interface, jumbo frames enabled
Fingerprint VMware ESX Server 4.0.1
Class VMware | ESX Server | 4.X | specialized
CPE cpe:/o:vmware:esx:4.0:1
SEQ(SP=FE-108%GCD=1-6%ISR=FD-113%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW3NNT11SLL%O2=M5B4NW3NNT11SLL%O3=M5B4NW3NNT11%O4=M5B4NW3NNT11SLL%O5=M5B4NW3NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW3SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW3NNT11SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESX Server 5.X
Fingerprint VMware ESX Server 5
Class VMware | ESX Server | 5.X | specialized
CPE cpe:/o:vmware:esx:5
SEQ(SP=100-10E%GCD=1-6%ISR=106-112%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW3NNT11SLL%O2=M5B4NW3NNT11SLL%O3=M5B4NW3NNT11%O4=M5B4NW3NNT11SLL%O5=M5B4NW3NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW3SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW3NNT11SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4
Fingerprint VMware ESXi 3.0 - 4.0
Class VMware | ESXi | 3.X | specialized
CPE cpe:/o:vmware:esxi:3
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4
SEQ(SP=FC-10A%GCD=1-6%ISR=105-10F%TI=RI%TS=7)
OPS(O1=M5B4NW1NNT11SLL%O2=M5B4NW1NNT11SLL%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11SLL%O5=M5B4NW1NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11SLL%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 3.5 Server
Fingerprint VMware ESXi 3.5
Class VMware | ESXi | 3.X | specialized
CPE cpe:/o:vmware:esxi:3.5
SEQ(SP=F6-106%GCD=1-6%ISR=104-10E%TI=Z%CI=RI%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=0-FFFF%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# esxi-3.5-update5
Fingerprint VMware ESXi 3.5
Class VMware | ESXi | 3.X | specialized
CPE cpe:/o:vmware:esxi:3.5
SEQ(SP=FC-10A%GCD=1-6%ISR=106-110%TI=Z%II=RI%TS=7)
OPS(O1=M564NW1NNT11%O2=M564NW1NNT11%O3=M564NW1NNT11%O4=M564NW1NNT11%O5=M564NW1NNT11%O6=M564NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW1%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 3.5.0
Fingerprint VMware ESXi 3.5
Class VMware | ESXi | 3.X | specialized
CPE cpe:/o:vmware:esxi:3.5
SEQ(SP=FE-108%GCD=1-6%ISR=103-10F%TI=Z%II=RI%TS=7-9)
OPS(O1=M1F4NW1NNT11%O2=M1F4NW1NNT11%O3=M1F4NW1NNT11%O4=M1F4NW1NNT11%O5=M1F4NW1NNT11%O6=M1F4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N|Y%T=3B-45|FA-104%TG=40|FF%W=FFFF%O=M1F4NW1%CC=N)
T1(R=Y%DF=N|Y%T=3B-45|FA-104%TG=40|FF%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMWare ESXi 4
Fingerprint VMware ESXi 4.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.0
SEQ(SP=FB-107%GCD=1-6%ISR=105-10F%TI=I%II=I%SS=S%TS=7)
OPS(O1=M564NW1NNT11%O2=M564NW1NNT11%O3=M564NW1NNT11%O4=M564NW1NNT11%O5=M564NW1NNT11%O6=M564NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4
Fingerprint VMware ESXi 4.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.0
SEQ(SP=F7-101%GCD=1-6%ISR=FF-109%TI=I%II=I%SS=O|S%TS=7)
OPS(O1=M5B4NW1NNT11SLL%O2=M5B4NW1NNT11SLL%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11SLL%O5=M5B4NW1NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Esxi 4.0 (update 0 presumably)
# Esxi 4.0 update 3
Fingerprint VMware ESXi 4.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.0
SEQ(SP=F9-10B%GCD=1-6%ISR=105-111%TI=I%II=I%SS=S%TS=6|7)
OPS(O1=M564NW1NNT11SLL%O2=M564NW1NNT11SLL%O3=M564NW1NNT11%O4=M564NW1NNT11SLL%O5=M564NW1NNT11SLL%O6=M564NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW1SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4.0.0 build 208167
Fingerprint VMware ESXi 4.0.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.0
SEQ(SP=EA-10C%GCD=1-6%ISR=109-113%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW1NNT11SLL%O2=M5B4NW1NNT11SLL%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11SLL%O5=M5B4NW1NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SLL%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11SLL%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ESXi 4.0 Update 1
Fingerprint VMware ESXi 4.0.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.0:1
SEQ(SP=FC-108%GCD=1-6%ISR=108-112%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW1NNT11SLL%O2=M5B4NW1NNT11SLL%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11SLL%O5=M5B4NW1NNT11SLL%O6=M5B4NNT11SLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW1SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11SLL%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4.1
# vSphere ESXi 4.1
# VMWare ESXi, 4.1.0, 260247
# VMware vSphere Hypervisor 4.1 (ESXi)
# VMWare ESXi 4 update 1
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=68-F8%GCD=1-6%ISR=F0-100%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=80-EC%GCD=C|18|24|30|3C|48%ISR=F4-FE%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 4.1.0
# vmware esxi 4.1.0,320137
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=7F-DF%GCD=9|12|1B|24|2D%ISR=F9-103%TI=I%CI=I%II=I%SS=O|S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=O|S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMWare ESXi Server 4.1
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=96-B0%GCD=1-6%ISR=F7-101%TI=RI%CI=I%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# vSphere ESXi 4.1
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=84-B4%GCD=2|4|6|8|A%ISR=F5-FF%TI=I%CI=I%II=I%SS=O%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N|Y%T=3B-45%TG=40%W=FFFF%S=O%A=O|S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 4.1.0
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=BA-F4%GCD=3|6|9|C|F%ISR=F4-FE%TI=I%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# VMware ESXi, 4.1.0, 260247
# Esxi 4.1.0
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=94-D8%GCD=8|10|18|20|28%ISR=F5-FF%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S|O%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware, Inc. VMware ESXi 4.1.0 build-260247
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=71-AB%GCD=B|16|21|2C|37%ISR=F7-101%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 4.1u1
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=A9-F5%GCD=7|E|15|1C|23%ISR=F1-FB%TI=I%II=I%SS=S%TS=7)
OPS(O1=M564NW4ST11%O2=M564NW4ST11%O3=M280NW4NNT11%O4=M564NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW4SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 4.1
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=98-CA%GCD=7|E|15|1C|23%ISR=F4-FE%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4.1.0 Build 348481 on HP DL380 G7
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=7B-DD%GCD=2|4|6|8|A%ISR=F5-FF%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Esxi 4.1 (update 0 presumably)
Fingerprint VMware ESXi 4.1
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=F6-102%GCD=1-6%ISR=FD-109%TI=I%II=I%SS=S%TS=7)
OPS(O1=M564NW4ST11%O2=M564NW4ST11%O3=M280NW4NNT11%O4=M564NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW4SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMWare 4.1.0,260247
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=C1-117%GCD=1-6%ISR=F5-FF%TI=I|RD%II=I%SS=S%TS=7)
OPS(O1=M4ECNW4ST11%O2=M4ECNW4ST11%O3=M280NW4NNT11%O4=M4ECNW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M4ECNW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4.1.0 build-260247
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=81-AB%GCD=9|12|1B|24|2D%ISR=F4-FE%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESX Server 4.X
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=70-A4%GCD=7|E|15|1C|23%ISR=F1-FB%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMWare ESXi, 4.1.0, 320137 running on HP ProLiant Server.
# ESXi 4.1
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=B0-D9%GCD=7|E|15|1C|23%ISR=F4-100%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW4ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 4.1.0 (VMKernel Release Build 348481)
# VMkernel my.hostname.here 4.1.0 #1 SMP Release build-348481 Jan 12 2011 17:05:17 x86_64 unknown
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=CC-D6%GCD=1-6|8%ISR=F5-FF%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi VMkernel 4.1.0 Release build-260247
Fingerprint VMware ESXi 4.1.0
Class VMware | ESXi | 4.X | specialized
CPE cpe:/o:vmware:esxi:4.1
SEQ(SP=82-142%GCD=7|E|15|1C|23%ISR=F6-110%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M550NW4ST11%O2=M550NW4ST11%O3=M550NW4NNT11%O4=M5B4NW4ST11%O5=M550NW4ST11%O6=M550ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M550NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=O%F=AS%O=M5B4%RD=0%Q=)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=Z%F=R%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 5.0
Fingerprint VMware ESXi 5.0
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.0
SEQ(SP=9D-B3%GCD=9|12|1B|24|2D%ISR=F4-FE%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW4ST11%O2=M578NW4ST11%O3=M280NW4NNT11%O4=M5B4NW4ST11%O5=M218NW4ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW4SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 5.0.0 (VMKernel Release Build 504890)
Fingerprint VMware ESXi 5.0
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.0
SEQ(SP=AB-B5%GCD=1-6%ISR=F6-100%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW9ST11%O2=M578NW9ST11%O3=M280NW9NNT11%O4=M5B4NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW9SLL%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW9ST11%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=N)
T6(R=N)
T7(R=N)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# 5.0.0,821926
Fingerprint VMware ESXi 5.0
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.0 auto
SEQ(SP=102-10C%GCD=1-6%ISR=101-10B%TI=I%TS=7)
OPS(O1=M488NW9ST11%O2=M488NW9ST11%O3=M280NW9NNT11%O4=M564NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M488NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(R=N)
IE(R=N)

# VMware vSphere Hypervisor v5.0.0 Update 1
# VMware ESX Server 5.X
# VMware ESXi 5.5.0 Build 1281650
Fingerprint VMware ESXi 5.0 - 5.5
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5
SEQ(SP=A6-F8%GCD=1-6|8|10|18|20|28%ISR=F9-103%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW9ST11%O2=M578NW9ST11%O3=M280NW9NNT11%O4=M5B4NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW9ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 5.1 Update 1 Build 1157734
Fingerprint VMware ESXi 5.1
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.1
SEQ(SP=EC-F6%GCD=1-6%ISR=FE-108%TI=I%II=I%SS=S%TS=7)
OPS(O1=M564NW9ST11%O2=M564NW9ST11%O3=M280NW9NNT11%O4=M564NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M564NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ESXi 5.5
Fingerprint VMware ESXi 5.5
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.5
SEQ(SP=C6-D0%GCD=9|12|1B|24|2D%ISR=F1-FB%TI=RD|RI%CI=I%II=I%TS=7)
OPS(O1=M5B4NW9ST11%O2=M578NW9ST11%O3=M280NW9NNT11%O4=M5B4NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW9ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMkernel  5.5.0 #1 SMP Release build-1892794 Jun 11 2014 17:50:49 x86_64 GNU/Linux
Fingerprint VMware ESXi 5.5
Class VMware | ESXi | 5.X | specialized
CPE cpe:/o:vmware:esxi:5.5
SEQ(SP=84-B8%GCD=2|4|6|8|A%ISR=F2-FC%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW9ST11%O2=M578NW9ST11%O3=M280NW9NNT11%O4=M5B4NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M109NW9ST11%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware ESXi 6.0.0 (VMKernel Release Build 2494585)
Fingerprint VMware ESXi 6.0.0
Class VMware | ESXi | 6.X | specialized
CPE cpe:/o:vmware:esxi:6.0.0 auto
SEQ(SP=71-9F%GCD=2|4|6|8|A%ISR=F1-FB%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW9ST11%O2=M578NW9ST11%O3=M280NW9NNT11%O4=M5B4NW9ST11%O5=M218NW9ST11%O6=M109ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FFFF%O=M5B4NW9SLL%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VMware Player running over Windows 7, accessible from NAT network. (Looks like Windows with some differences --ed.)
Fingerprint VMware Player virtual NAT device
Class VMware | Player || specialized
CPE cpe:/a:vmware:player
SEQ(SP=F1-FB%GCD=1-6%ISR=FA-104%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=FAF0)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=FAF0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=FAF0%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=7FFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=7FFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=7FFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=7FFF%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=7B-85%TG=80%CD=Z)

# EasyBox 802 (with DLNA firmware)
Fingerprint Vodafone EasyBox 802 wireless ADSL router
Class Vodafone | embedded || WAP
CPE cpe:/h:vodafone:easybox_802 auto
SEQ(SP=100-10A%GCD=1-6%ISR=FE-10C%TI=Z%CI=RD|RI%II=I%TS=A|C-E)
OPS(O1=M564ST11NW1%O2=M564ST11NW1%O3=M564NNT11NW1%O4=M564ST11NW1%O5=M564ST11NW1%O6=M564ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M564NNSNW1%CC=Y)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=100%S=Z%A=S+%F=AR%RD=0)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=400%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7A69%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=8000%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=FFFF%S=Z%A=S+%F=AR%RD=0)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Vodafone Easybox 904 xDSL, AT904X-03.16 (Linux 2.6.32.32 #3 Thu Jul 24 16:08:30 CST 2014)
Fingerprint Vodafone Easybox 904 xDSL WAP (Linux 2.6.32)
Class Vodafone | embedded || WAP
CPE cpe:/h:vodafone:easybox_904_xdsl
Class Linux | Linux | 2.6.X | WAP
CPE cpe:/o:linux:linux_kernel:2.6.32
SEQ(SP=C4-CE%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=U)
OPS(O1=M5B4NNSNW2%O2=M5B4NNSNW2%O3=M5B4NW2%O4=M5B4NNSNW2%O5=M5B4NNSNW2%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4NNSNW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Vodafone DSL-Easybox A601 WLAN
Fingerprint Vodafone EasyBox A601 wireless ADSL router
Class Vodafone | embedded || WAP
CPE cpe:/h:vodafone:easybox_a601 auto
SEQ(SP=11-1F%GCD=1-6%ISR=4B-55%TI=I%CI=I%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=5000%W2=5000%W3=5000%W4=5000%W5=5000%W6=5000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=5000%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=5000%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=CFC2%RUD=G)
IE(R=N)

# Vonage V-Portal device.
Fingerprint Vonage V-Portal VoIP adapter
Class Vonage | embedded || VoIP adapter
CPE cpe:/h:vonage:v-portal
SEQ(SP=101-10B%GCD=1-6%ISR=103-10D%TI=I%TS=7)
OPS(O1=M5ACNW0NNT11%O2=M5ACNW0NNT11%O3=M5ACNW0NNT11%O4=M5ACNW0NNT11%O5=M5ACNW0NNT11%O6=M5ACNNT11)
WIN(W1=4380%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=Y%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# embedded OS for the VTrak RAID product: WebPAM PROe version "10.06.2270.00 for Mac"
Fingerprint VTrak WebPAM PROe RAID device
Class VTrak | embedded || storage-misc
SEQ(SP=C1-CB%GCD=1-6%ISR=BE-C8%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M2300ST11NW2%O2=M2300ST11NW2%O3=M2300NNT11NW2%O4=M2300ST11NW2%O5=M2300ST11NW2%O6=M2300ST11)
WIN(W1=45E8%W2=45E8%W3=45E8%W4=45E8%W5=45E8%W6=45E8)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4600%O=M2300NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3C-46%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Wiesemann & Theis GmbH (WuT) COM-Server
Fingerprint W&T Ethernet-to-serial bridge
Class W&T | embedded || bridge
CPE cpe:/h:w%26t:com-server
SEQ(SP=0-5%GCD=1-6%ISR=16-20%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M230%O5=M230%O6=M230)
WIN(W1=230%W2=230%W3=230%W4=230%W5=230%W6=230)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=230%O=M230%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# WEBIO-047EFE
Fingerprint W&T Web-IO controller
Class W&T | embedded || specialized
SEQ(SP=0-5%GCD=2|4|6|8|A%ISR=1E-28%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M230%O5=M230%O6=M230)
WIN(W1=230%W2=230%W3=230%W4=230%W5=230%W6=230)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=230%O=M230%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# W&T Web-Thermometer #57101
Fingerprint W&T Web-IO Thermometer model 57101
Class W&T | embedded || specialized
CPE cpe:/h:w%26t:web-thermometer
SEQ(SP=0-5%GCD=1-6%ISR=16-20%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=200%W2=200%W3=200%W4=200%W5=200%W6=200)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=200%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=22-3F%TG=40%W=0%S=A%A=S%F=APR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=22-40%TG=40%W=0%S=A%A=S+%F=APR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=21-37%TG=40%W=0%S=A%A=S%F=APR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=21-3A%TG=40%W=0%S=A%A=S+%F=APR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=23-40%TG=40%W=0%S=A%A=S%F=APR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=22-3D%TG=40%W=0%S=A%A=S+%F=APR%O=%RD=0%Q=)
U1(DF=N%T=32-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=2C-40%TG=40%CD=S)

# W&T Web-Thermo-Hygrobarograph PoE #57613 Firmware: 1.59
# Device: W&T Web-Thermo-Hygrobarograph PoE #57613 Firmware: 1.71
Fingerprint W&T Web-Thermo-Hygrobarograph firmware 1.59 - 1.71
Class W&T | embedded || specialized
CPE cpe:/h:w%26t:web-thermo-hygrobarograph
SEQ(SP=87-B7%GCD=1-6%ISR=87-B7%TI=I|RD%CI=I%II=I%TS=U)
OPS(O1=|M230%O2=|M230%O3=|M230%O4=|M230%O5=|M230%O6=|M230)
WIN(W1=230%W2=230%W3=230%W4=0|230%W5=230%W6=0|230)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128|C028%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# W&T Web-Thermograph NTC, 10/100BT, 12-24V, firmware version '1.50/1.30'
Fingerprint W&T Web-Thermograph NTC
Class W&T | embedded || specialized
CPE cpe:/h:w%26t:web-thermograph_ntc
SEQ(SP=70-7A%GCD=2|4|6|8|A%ISR=69-73%TI=I|RD%CI=I%II=I%SS=O%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=)
WIN(W1=200%W2=200%W3=200%W4=200%W5=200%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=200%O=M200%CC=N%Q=|U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# W&T Web-Thermograph NTC, 10/100BT, 12-24V, firmware version '1.53'
# W&T Web-Thermograph NTC#57609 Firmware: 1.53
Fingerprint W&T Web-Thermograph NTC firmware 1.53
Class W&T | embedded || specialized
CPE cpe:/h:w%26t:web-thermograph_ntc
SEQ(SP=84-90%GCD=1-6%ISR=83-93%TI=I|RD%CI=I%II=I%SS=O%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M230%O5=M230%O6=)
WIN(W1=230%W2=230%W3=230%W4=230%W5=230%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=A|AR|AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# W&T Web-Thermo-Hygrobarograph PoE #57613 Firmware: 1.60
Fingerprint W&T Web-Thermograph NTC firmware 1.60
Class W&T | embedded || specialized
CPE cpe:/h:w%26t:web-thermograph_ntc
SEQ(SP=6D-77%GCD=1-6%ISR=68-72%TI=I|RD%CI=I%II=I%SS=O%TS=U)
OPS(O1=M230%O2=M230%O3=M230%O4=M230%O5=M230)
WIN(W1=230%W2=230%W3=230%W4=230%W5=230%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%CC=N%Q=U)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# WAGO IO System 750 Ethernet fieldbus coupler. Firmware revision 02.02.00(04)
Fingerprint WAGO-I/O-SYSTEM 750 automation system
Class WAGO | embedded || specialized
CPE cpe:/h:wago:wago-i%2f-system_750
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4LLW1NT11%O2=M5B4LLW1NT11%O3=M5B4LLW1NT11%O4=M5B4LLW1NT11%O5=M5B4LLW1NT11%O6=M5B4NNT11)
WIN(W1=5DC%W2=5DC%W3=5DC%W4=5DC%W5=5DC%W6=5DC)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=5DC%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=5DC%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=5DC%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Watchguard Firebox II 500
Fingerprint WatchGuard FireBox 500 firewall
Class WatchGuard | embedded || firewall
CPE cpe:/h:watchguard:firebox_500
SEQ(SP=101-10B%GCD=1-6%ISR=106-110%TI=I%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4%CC=S%Q=RU)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=S+%F=ASF%O=M109%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# WatchGuard FireBox 700
# WatchGuard Firebox X700, OS Fireware 7.5
Fingerprint WatchGuard FireBox 700 or X700 firewall
Class WatchGuard | embedded || firewall
CPE cpe:/h:watchguard:firebox_700
CPE cpe:/h:watchguard:firebox_x700
SEQ(SP=EF-10F%GCD=1-6%ISR=108-112%TI=I%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=3FE0%W2=3FE0%W3=3FE0%W4=3FE0%W5=3FE0%W6=3FE0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=3FE0%O=M5B4%CC=S%Q=RU)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=3FE0%S=O%A=S+%F=ASF%O=M109%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Watchguard Firebox x5 Wireless
# Watchguard Firebox x5 firewall version  7.5.2  Boot ROM  7.2.1
# Watchguard SOHO 6 v. 6.4.1, Mar 25 2005, build 15, Boot ROM 5.6
Fingerprint WatchGuard Firebox SOHO 6 or X5w firewall/WAP
Class WatchGuard | embedded || firewall
CPE cpe:/h:watchguard:firebox_x5w
CPE cpe:/h:watchguard:firebox_soho_6
Class WatchGuard | embedded || WAP
CPE cpe:/h:watchguard:firebox_x5w
CPE cpe:/h:watchguard:firebox_soho_6
SEQ(SP=EA-10E%GCD=1-6%ISR=FE-112%TI=RD%CI=RD%II=RI%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=80%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=400%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=8000%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Watchguard Firebox x1250e Core
Fingerprint WatchGuard FireBox X1250e firewall
Class WatchGuard | embedded || firewall
CPE cpe:/h:watchguard:firebox_x1250e
SEQ(SP=C6-D0%GCD=1-6%ISR=D1-DB%TI=Z%CI=Z%II=I%TS=8)
OPS(O1=M578ST11NW5%O2=M578ST11NW5%O3=M578NNT11NW5%O4=M578ST11NW5%O5=M578ST11NW5%O6=M578ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M578NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# XTM 525
Fingerprint WatchGuard XTM 525 firewall
Class WatchGuard | embedded || firewall
CPE cpe:/h:watchguard:xtm_525 auto
SEQ(SP=FD-107%GCD=1-6%ISR=106-110%TI=Z%CI=Z%II=I%TS=6|8)
OPS(O1=M578ST11NW1%O2=M578ST11NW1%O3=M578NNT11NW1%O4=M578ST11NW1%O5=M578ST11NW1%O6=M578ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# WatchGuard Fireware v11.3.4
Fingerprint WatchGuard firewall (Fireware 11.3)
Class WatchGuard | Fireware | 11.X | firewall
CPE cpe:/o:watchguard:fireware:11.3 auto
SEQ(SP=C4-CE%GCD=1-6%ISR=C3-CD%TI=Z%II=I%TS=8)
OPS(O1=M574ST11NW5%O2=M574ST11NW5%O3=M574NNT11NW5%O4=M574ST11NW5%O5=M574ST11NW5%O6=M574ST11)
WIN(W1=1680%W2=1680%W3=1680%W4=1680%W5=1680%W6=1680)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16B0%O=M574NNSNW5%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Watchguard XTM-26W running Fireware 11.8.3 (Looks like Linux 3.X)
Fingerprint WatchGuard Fireware 11.8
Class WatchGuard | Fireware | 11.X | firewall
CPE cpe:/o:watchguard:fireware:11.8 auto
SEQ(SP=FC-106%GCD=1-6%ISR=104-10E%TI=Z%II=I%TS=8|A)
OPS(O1=M576ST11NW3%O2=M576ST11NW3%O3=M576NNT11NW3%O4=M576ST11NW3%O5=M576ST11NW3%O6=M576ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M576NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Fireware XTM
Fingerprint WatchGuard firewall (Fireware XTM)
Class WatchGuard | Fireware | XTM | firewall
CPE cpe:/o:watchguard:fireware:xtm auto
SEQ(SP=C5-CF%GCD=1-6%ISR=C6-D0%TI=Z%II=RI%TS=7)
OPS(O1=M578ST11NW2%O2=M578ST11NW2%O3=M578NNT11NW2%O4=M578ST11NW2%O5=M578ST11NW2%O6=M578ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M578NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Websense proxy server, Linux-based
Fingerprint Websense Content Gateway
Class WebSense | embedded || proxy server
Class Linux | Linux || proxy server
CPE cpe:/o:linux:linux_kernel auto
SEQ(SP=F9-105%GCD=1-6%ISR=106-110%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M598ST11NW7%O2=M598ST11NW7%O3=M598NNT11NW7%O4=M598ST11NW7%O5=M598ST11NW7%O6=M598ST11)
WIN(W1=3778%W2=3778%W3=3778%W4=3778%W5=3778%W6=3778)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=37F0%O=M598NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3A-44%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3A-44%TG=40%CD=S)

# Welltech ATA-171 h323 VoIP Gateway SIP build-in NAT Firmware Version: s1_105
Fingerprint Welltech ATA-171 VoIP adapter
Class Welltech | embedded || VoIP adapter
CPE cpe:/h:welltech:ata-171 auto
SEQ(R=N)
OPS(O1=M5B4%O2=M578W0ST10L%O3=M280|T10NNW5NM280%O4=M5B4|ST10WAL%O5=M218|M218ST10WAL%O6=M109|M109ST10)
WIN(W1=3180%W2=0%W3=0|3180%W4=0|3180%W5=0|3180%W6=0|3180)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0|3180%O=M5B4|WANM5B4SNN%CC=N%Q=|R)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Westell WireSpeed B90-220030-04 DSL Modem powered by WindRiver software (embedded)
Fingerprint Westell WireSpeed B90-220030-04 DSL router (VxWorks)
Class Westell | embedded || broadband router
CPE cpe:/h:westell:wirespeed_b90-220030-04
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Westell WireSpeed Dual Connect 6100 DSL Modem
Fingerprint Westell WireSpeed Dual Connect 6100 DSL router
Class Westell | embedded || broadband router
CPE cpe:/h:westell:wirespeed_6100
SEQ(SP=95-9F%GCD=1-6%ISR=9C-A6%TI=I%CI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(R=N)

# Westermo EDW-100 Ethernet Serial Controller
Fingerprint Westermo EDW-100 Ethernet-to-serial bridge
Class Westermo | embedded || bridge
CPE cpe:/h:westermo:edw-100
SEQ(SP=CE-D8%GCD=1-6%ISR=D5-DF%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M5B4W0L%O3=M5B4W0L%O4=M5B4W0L%O5=M5B4W0L%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=6D-77%TG=80%W=2000%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=6D-77%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=6D-77%TG=80%W=2000%S=O%A=S+%F=AS%O=M5B4W0L%RD=0%Q=)
T4(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=6D-77%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=6D-77%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=6D-77%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=94B6%RUD=G)
IE(DFI=N%T=6D-77%TG=80%CD=Z)

# Linux 2.6 --Ed.
# WD TV Live HD media player Firmware Release 1.05.04 (5/12/2011)
Fingerprint Western Digital WD TV media player
Class Western Digital | embedded || media device
CPE cpe:/o:westerndigital:wd_tv
CPE cpe:/o:westerndigital:linux:2.6 auto
SEQ(SP=C2-E0%GCD=1-6%ISR=C3-DB%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# WD DL4100
Fingerprint Western Digital My Cloud DL4100 NAS (Linux 3.10)
Class Western Digital | embedded || storage-misc
Class Linux | Linux | 3.X | general purpose
CPE cpe:/o:linux:linux_kernel:3.10 auto
SEQ(SP=F1-10B%GCD=1-6%ISR=106-110%TI=Z%CI=I|Z%II=I%TS=U)
OPS(O1=M5B4NNSNW9%O2=M5B4NNSNW9%O3=M5B4NW9%O4=M5B4NNSNW9%O5=M5B4NNSNW9%O6=M5B4NNS)
WIN(W1=3908%W2=3908%W3=3908%W4=3908%W5=3908%W6=3908)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW9%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Dell laser printer 1600n V1.11(1600n)
# Dell Laser MFP 1600n OS Ver. 1.21 Nic ver. 1.11
# samsung ML-2150 series printer
# "Samsung KS32C" microcontroller. This device uses for sure "pSOSystem". http://www.windriver.com/products/run-time_technologies/Real-Time_Operating_Systems/pSOS/
Fingerprint Wind River pSOSystem
Class Wind River | pSOSystem || specialized
CPE cpe:/o:windriver:psosystem auto
SEQ(SP=C-46%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-BB%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# HP Procurve 2650 (firmware H.07.50)
# Xerox Phaser 8550DT. Operating System: 4.302. PostScript: 4.8.0
# Xerox Phaser 7400N network printer
# Cisco C1230B running vxWorks 12.01T1
# Cisco 1200 Series AP 12.01T1 (AIR-AP-1220B-E-K9) running VxWorks 12.01A
# Remote System Controller (RSC) card of a Sun Fire 280R server, RSC Version: 2.2.3
# Nortel Ethernet Switch 470-48T-PWR. FW:3.6.0.6   SW:v3.6.3.04 ISVN:2.
# 3COM wireless Access Point 7250
# Nortel Business Policy Switch 2000, FW:3.0.0.5   SW:v3.1.0.78 ISVN:2
# sun rsc (Remote Sytem Control) card. It runs RSC version 2.2.
# Schneider Electric Quantum (SPS)
Fingerprint VxWorks 12.0
Class Wind River | VxWorks | 12.X | general purpose
CPE cpe:/o:windriver:vxworks:12.0 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Nomadix AG5800 - an access gateway for billing etc.
Fingerprint Nomadix AG 5800 access gateway (VxWorks)
Class Wind River | VxWorks | 12.X | router
CPE cpe:/o:windriver:vxworks:12 auto
Class Nomadix | embedded || router
CPE cpe:/h:nomadix:ag_5800
SEQ(SP=94-9E%GCD=1-6%ISR=95-9F%TI=BI%CI=RD%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=EA60%W2=EA60%W3=EA60%W4=EA60%W5=EA60%W6=EA60)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=EA60%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# VxWorks 5.3 on Motorola SB3100
Fingerprint Motorola SURFboard SB3100 cable modem (VxWorks 5.3)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.3 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb3100 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=N)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Motorola Surfboard 3100 Cable Modem, VxWorks Version: 5.3, Software Version: SB3100-3.0.7-SCM-NOSHELL
Fingerprint Motorola SURFboard SB3100 cable modem (VxWorks 5.3)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.3 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb3100 auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=84E%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Software Version: SB3100-1.4.9.3-SCM00-NOSH, Hardware Version: 1, MIB Version: II, GUI Version: 1.0, VxWorks Version: 5.3
Fingerprint Motorola SURFboard SB3100 cable modem (VxWorks 5.3)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.3 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb3100 auto
SEQ(SP=D-17%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Motorola Cable Modem SB5100E  SB5100E-2.3.3.0-SCM00-NOSH  Hardware Version: 3 VxWorks Version: 5.4
Fingerprint Motorola SURFboard SB5100E cable modem (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb5100e auto
SEQ(SP=17-19%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=9C-9E%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SB5100E-2.3.1.8-SCM00-NOSH, Hardware Version: 3, VxWorks Version: 5.4
Fingerprint Motorola SURFboard SB5100E cable modem (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb5100e auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Motorola Surfboard Cable Modem, SB5120-2.19.0.8-SCM02-NOSH, VxWorks Version: 5.4
Fingerprint Motorola SURFboard SB5120 cable modem (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb5120 auto
SEQ(SP=17-21%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9B-A5%TI=I|RD%II=I%SS=S%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# SB5120
Fingerprint Motorola SURFboard SB5120 cable modem (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb5120 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Model Name: SBV5121 Firmware Version: 17.2.34-SCM-04 Vendor Name: Motorola BCMA Software Version: 52.45 MIB Version: II VxWorks Version: 5.4
Fingerprint Motorola SURFboard SBV5121 broadband router (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | broadband router
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sbv5121 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=RI%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Linksys cable modem BEFCMU10
# Motorola SB5100 (VxWorks 5.X)
# BayStack 460 - 24T - PWR     HW:07       FW:3.0.0.5   SW:v3.0.6.08 ISVN:2
Fingerprint Nortel BayStack 460 switch, or Linksys BEFCMU10 or Motorola SURFboard SB5100 cable modem
Class Wind River | VxWorks | 5.X | general purpose
CPE cpe:/o:windriver:vxworks:5 auto
Class Linksys | embedded || broadband router
CPE cpe:/h:linksys:befcmu10
Class Motorola | embedded | 5.X | broadband router
CPE cpe:/h:motorola:surfboard_sb5100 auto
Class Nortel | embedded | 5.X | switch
CPE cpe:/h:nortel:baystack_460 auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Netgear WPN824 -- hwversion:V2H1 -- fwversion:V2.0.6_1.2.17NA
# Linksys WAP55AG Firmware Version: 1.1(ETSI), Mar 17, 2005
# It is a ReplayTV 5500.
# It is a WAP51AB
# HP/Compaq Remote Insight Lights Out Edition II running firmware v1.21
# Proxim Wireless Networks AP-4000M, v3.6.0(1168)
# Compaq Remote Insight Lights-Out Edition II
# Cisco Wireless Access Point, AIR-AP1010-E-K9,  Software Version 4.0.206.0
# Sun(tm) Advanced Lights Out Manager 1.2
# D-Link DWL-2100AP running Atheros Access Point Rev 4.0.0.167 firmware
# D-Link DWL-3200AP
# Ricoh Aficio SP C220N |   VULNERABLE: Wind River Systems VxWorks debug service enabled. See http://www.kb.cert.org/vuls/id/362332 |   VxWorks version: 5.4.2
Fingerprint VxWorks 5.4.2
Class Wind River | VxWorks | 5.X | general purpose
CPE cpe:/o:windriver:vxworks:5.4.2
SEQ(SP=13-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# IBM DS4800 storage array, which is a rebadged OEM LSI/Engenio system
# TP-LINK TL-WA500G" Wireless Access Point Hardware Version: "1.3 081520C2" Software Version: "4.2.3 Build 090707 Rel.37067n" VxWorks 5.5
# Cisco SPA300-series VoIP phone. GNU C 2.96-mips3264-010729 (2.96+) VxWorks 5.5 -g
# Rockwell 1756-ENBT ControlLogix Ethernet/IP Adapter Version 6.006 (VxWorks 5.5)
Fingerprint VxWorks 5.5
Class Wind River | VxWorks | 5.X | general purpose
CPE cpe:/o:windriver:vxworks:5.5 auto
SEQ(SP=94-9E%GCD=1-6%ISR=9A-A4%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks Version 5.5.1 for IBM PowerPC Running on embedded system (Allied Telesis, Inc. (ATI) iMAP 9700)
Fingerprint VxWorks 5.5.1
Class Wind River | VxWorks | 5.X | general purpose
CPE cpe:/o:windriver:vxworks:5.5.1 auto
SEQ(SP=95-9F%GCD=1-6%ISR=9C-A6%CI=I%II=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=64%W2=64%W3=64%W4=64%W5=64%W6=64)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=64%O=M5B4NW0%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=64%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0)
T4(R=Y%DF=N%T=3B-45%TG=40%W=64%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks (for M-PENTIUM3) version 5.5.1.  Kernel: WIND version 2.6.  Made on Aug  3 2011, 11:37:11.
Fingerprint VxWorks 5.5.1
Class Wind River | VxWorks | 5.X | general purpose
CPE cpe:/o:windriver:vxworks:5.5.1 auto
SEQ(SP=101-10B%GCD=4|8|C|10|14%ISR=106-110%TS=B)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Nortel Meridian PABX, VxWorks 5.X
Fingerprint Nortel Meridian PBX
Class Wind River | VxWorks | 5.X | PBX
CPE cpe:/o:windriver:vxworks:5 auto
Class Nortel | embedded || PBX
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Arris Cadant C3 cable modem termination system, Application image: 4.4.0.59, Apr 24 2007, 15:27:54, BootRom version 4.2.0.2, VxWorks5.4.2
Fingerprint Arris Cadant C3 cable modem terminator (VxWorks 5.4.2)
Class Wind River | VxWorks | 5.X | router
CPE cpe:/o:windriver:vxworks:5.4.2 auto
Class Arris | embedded || router
CPE cpe:/h:arris:cadant_c3 auto
SEQ(SP=96-A0%GCD=1-6%ISR=9C-A6%TI=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Bachmann Electronics embedded RTOS Programmable Logic Controller running VxWorks 5.5
Fingerprint VxWorks 5.5
Class Wind River | VxWorks | 5.X | specialized
CPE cpe:/o:windriver:vxworks:5.5 auto
SEQ(SP=100-10A%GCD=1-6%ISR=102-10C%TI=I%CI=I%II=I%TS=B)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Cisco AP340 (First-Generation WAP), Code Release: 12.05, VxWorks version 5.4 (Circa 2002)
Fingerprint Cisco AP340 WAP (VxWorks 5.4)
Class Wind River | VxWorks | 5.X | WAP
CPE cpe:/o:windriver:vxworks:5.4 auto
Class Cisco | embedded || WAP
CPE cpe:/h:cisco:ap340 auto
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks (for Netgear WPN824v2) version VxWorks5.4.2. Kernel: WIND version 2.5. Made on Oct  2 2006, 19:10:19.
# Netgear WGR614v7
# Netgear WPN824
# Netgear WGT624 v3 Wireless Firewall Router
Fingerprint Netgear WGR614v7, WGT624v3, or WPN824v2 WAP (VxWorks 5.4.2)
Class Wind River | VxWorks | 5.X | WAP
CPE cpe:/o:windriver:vxworks:5.4.2 auto
Class Netgear | embedded || WAP
CPE cpe:/h:netgear:wgr614
CPE cpe:/h:netgear:wgt624
CPE cpe:/h:netgear:wpn824
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks (for    ###    HW version 5    ###) version 6.4. Kernel: WIND version 2.10.
Fingerprint VxWorks 6.4
Class Wind River | VxWorks | 6.X | general purpose
CPE cpe:/o:windriver:vxworks:6.4 auto
SEQ(SP=FC-106%GCD=1-6%ISR=109-113%TI=I%CI=I%II=I%SS=S%TS=6|7)
OPS(O1=M538NW0NNT11%O2=M538NW0NNT11%O3=M538NW0NNT11%O4=M538NW0NNT11%O5=M538NW0NNT11%O6=M538NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M538NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M538NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks 6.6. ftp server message: "220 NanoDAC FTP server (VxWorks VxWorks 6.6) ready"
Fingerprint VxWorks 6.6
Class Wind River | VxWorks | 6.X | general purpose
CPE cpe:/o:windriver:vxworks:6.6 auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM592SNW0%O2=NNM592SNW0%O3=M592NW0%O4=NNM592SNW0%O5=NNM592SNW0%O6=NNM592S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM592SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# vxworks 6.8
Fingerprint VxWorks 6.8
Class Wind River | VxWorks | 6.X | general purpose
CPE cpe:/o:windriver:vxworks:6.8 auto
SEQ(SP=84-8E%GCD=1-6%ISR=93-9D%TI=BI|RD%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=FA00%W2=FA00%W3=FA00%W4=FA00%W5=FA00%W6=FA00)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=FA00%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Sun/Oracle StorageTek 2540-M2 management controller
# OS: VxWorks (for Meteor) version 6.5. Kernel: WIND version 2.10. Device: IBM DS3512
Fingerprint VxWorks 6.5 (NAS device)
Class Wind River | VxWorks | 6.X | storage-misc
CPE cpe:/o:windriver:vxworks:6.5 auto
SEQ(SP=88-9A%GCD=1-6%ISR=97-A1%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%RD=0)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# 7.X
Fingerprint VxWorks 7
Class Wind River | VxWorks | 7.X | general purpose
CPE cpe:/o:windriver:vxworks:7 auto
SEQ(SP=102-10C%GCD=1-6%ISR=106-110%TI=RD|RI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=EA60%W2=EA60%W3=EA60%W4=EA60%W5=EA60%W6=EA60)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=EA60%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Dick Smith Electronics XH1169 USB & 4x LAN ADSL Router
# Vendor: Ambit. modem-router provided by neuf telecom in france known as neufbox trio3c
# Netgear WGR614v6. VxWorks: http://forum.openwrt.org/viewtopic.php?id=3843 http://www.dd-wrt.com/phpBB2/viewtopic.php?t=44439&highlight=wgr614v6
Fingerprint Broadband router (VxWorks): Dick Smith Electronics XH1169, Netgear WGR614v6, or Neuf Box Trio 3C
Class Wind River | VxWorks || broadband router
CPE cpe:/o:windriver:vxworks auto
Class Dick Smith Electronics | embedded || broadband router
CPE cpe:/h:dicksmithelectronics:xh1169
Class Netgear | embedded || WAP
CPE cpe:/h:netgear:wgr614
Class Neuf | embedded || broadband router
CPE cpe:/h:neuf:neuf_box_trio_3c
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=I%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# USB Huawei E303s-2 mobile broadband/UMTS/GSM Stick.
Fingerprint Huawei E303s-2 broadband router (VxWorks)
Class Wind River | VxWorks || broadband router
CPE cpe:/o:windriver:vxworks auto
Class Huawei | embedded || broadband router
CPE cpe:/h:huawei:e303s-2 auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5B4SNW0%O2=NNM5B4SNW0%O3=M5B4NW0%O4=NNM5B4SNW0%O5=NNM5B4SNW0%O6=NNM5B4S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=NNM5B4SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Avaya G700 Telephony Media Gateway
# Konica Minolta 7145 printer
# Sun(tm) Advanced Lights Out Manager 1.5.2
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=18-1C%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=9D-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# 3Com Super Stack 4300 48x100Mbit Switch w. Firmware Version  V1.12 and Hardware Version 4.0
# Samsung ML-2571N printer, Main Firmware Version: OS 1.01.01.18 05-03-2007, Network Firmware Version: V4.02.05(ML-2571N) 04-25-2007
# Xerox Phaser 3125/N network printer
# Samsung 6555N Scanner/Printer/Copier
# Dell Remote Access Controller in a Dell Power Edge 2650, 3.12 (Build 04.26)
# Motorola Canopy 5.7Ghz AP running Software version: CANOPY 7.0.7 Mar 02 2005 15:06:58 AP-DES
# VxWorks? -- Ed.
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Motorola Surfboard SB5101 Cable Modem
# SB5101 help page says: Software Version: SB5101-2.4.1.6-SCM02-NOSH; Hardware Version: 1
# Scientific Atlanta WebSTAR EPX2203 cable modem, v2.0.2r1152-050419epx2203-v202r1152-050419c-eu-5.bin
# Baseline Switch 2948-SFP Plus
# FreeBSD 4.4-RELEASE FreeBSD 4.4-RELEASE #0: Tue Sep 18 11:57:08 PDT 2001 i386
# Tandberg 3000 MXP Video Conference System, Firmware Tandberg Release F7.0
# Allworx 24x PBX
# Tandberg Edge 95MXP
# Gigavue 2404 Gigamon Lawful interception/monitoring device
# IBC-Solar string inverter with a webinterface
# Gigamon GigaVUE-420 Data Access Switch, OS ver. 7.2.18.
# Cisco EPC3925 home DOCSIS modem/gateway.
# Netgear CGD24N-2BPAUS Firmware V4.4.4R11
# VxWorks? --Ed.
# Netgear cgd24nv3 model cable modem.
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=BE-108%GCD=1-6%ISR=E8-110%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# VxWorks --Ed.
# Filtrete 3m-50 WiFi Thermostat by 3M
# Radio Thermostat www.radiothermostat.com
# HP LaserJet CM1415fn
# HP LaserJet CP1525N Printer
# Vendor: Keyence Model: XG-7702 (version 4.1.0010) http://www.keyence.com/products/vision/machine/xg7000/xg7000.php
# HP Officejet Pro 8600 N911n
# Brother document scanner ADS-2600W
# HL-3170CDW
# HP LaserJet CM1415fnw
# HP LaserJet CP1525nw
# HP Laser Jet 1536dnf MFP
# Brother DCP-J4110DW
# Brother HL-3170CDW
# HP LaserJet 400 colorMFP M475dn (Firmware Version 20120808)
# MFC-J4510DW (VxWorks --ed.)
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=E7-10B%GCD=1-6%ISR=EB-117%TI=I|RD|RI%CI=I|RI%II=I%SS=S%TS=8|A|B)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2088%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2238%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# TOSHIBA e-STUDIO 3510c
# TOSHIBA e-STUDIO351c
# Toshiba e-Studio 520 copier, Firmware Version T390SY0U321, Main ROM Version 390M-14, Scanner ROM Version 390S-05
# Aastra ip phone 57i Revision 0, Firmware Version 2.3.0.82
# e-STUDIO 520 and an e-STUDIO 850
# TOSHIBA e-STUDIO281c multifunction printer
# Ethernet Routing Switch 4548GT-PWR    HW:06       FW:5.2.0.3   SW:v5.3.1.001 BN:01 (c) Nortel Networks
# Linksys WRT54GS2 running Linksys provided firmware version 1.0.02.
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=FB-10B%GCD=1-6%ISR=FF-10F%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Develop INEO+ 203
# Konica Minolta C203 PS Multi-function printer.
# Konica Minaolta magicolor 5670 EN
# Arris TM602G, Firmware Revision:      6.1.77
# ARRIS DOCSIS 2.0 / PacketCable 1.0 Touchstone Telephony Modem HW_REV: 32
# Konica Minolta Bizhub C452
# ARRIS DOCSIS 2.0 / PacketCable 1.0 Touchstone Telephony Modem HW_REV: 05, SW_REV: 6.1.38B MODEL: TM601A
# Konica Minolta bizhub 283
# Arris Interactive, L.L.C. MODEL: TM402G SW_REV: 6.1.77D.D11PLUS
# bizhub C203
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=FE-10A%GCD=1-6%ISR=FC-10E%TI=I%CI=I%II=I%SS=S%TS=8)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Mitel 3300CX IP PBX controller with 7.1 firmware. Probably using VxWorks.
# Enterasys SecureStack B2, Model B2G124-48
# Hewlett-Packard Integrity Integrated Lights-Out 2 Revision T.03.06
# Ethernet Routing Switch 5520-48T-PWR, HW:34       FW:5.0.0.4   SW:v5.1.0.014
# Mitel 3300 IP Communications Platform
# Enterasys Matrix N Series Platinum Version 06.11.01.0040
# Dell MFP Laser 3115cn, Firmware Version 200809190845
# Enterasys Networks, Inc. A2H124-24 Rev 02.01.03.0005
# ControlLogix Processor.  Access using RSLogix 5000 programming software (version 19)
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=93-9D%GCD=1-6%ISR=9A-A4%TI=I%II=I%SS=O|S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O|S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# hp MSA2324sa (msa2000 series). http-server identifies itself as "WindRiver-WebServer/4.4".
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=96-A0%GCD=1-6%ISR=9C-A6%TI=I%CI=I%II=I%SS=O|S%TS=1|3)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# HP StorageWorks, MSA2312i
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=96-A0%GCD=1-6%ISR=9D-A7%CI=I%II=I%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# ProCurve J9019A Switch 2510-24, Software revision Q.10.01
# ProCurve J4903A Switch 2824 Software revision I.08.105
# HP Procurve 2626-PWR, firmware H.08.98
# HP ProCurve Switch 5304XL - HP J4850A Switch 5304XL
# ProCurve Switch 2848
# HP ProCurve 5304xl (5300xl series) Modular Router/Switch (ROM version E.05.04, firmware revision E.10.37)
# Hewlett-Packard J4819A ProCurve Switch 5308xl [Software revision E.10.61]
# HP Procurve 2810-48G switch
# Thomson ST2030 VoIP Business Phone
# Thomson VoIP phone  ST2030
# ProCurve J8164A Switch 2626-PWR, Software revision H.10.38
# Thomson ST 2022 VoIP phone
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=95-A1%GCD=1-6%ISR=9B-A6%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O|S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Netgear SC101 Storage Central
# Compex WPE54G Wireless Access Point
# Xerox Phaser 6120/N Laser Printer
# Inter-Tel model 8662 VoIP phone, SW v. 2.0.06
# Hitachi WMS 100 SAN Controller, OS Version 0070/G-X
# Hitachi WMS 100 SAN Controller, OS Version 0770/G-X
# ALOM 1.6.3 on Sun Fire V210.
# Sun(tm) Advanced Lights Out Manager CMT v1.2.4
# Sony LocationFree device (used to transmit television broadcasts within a home)
# Allen-Bradley ControlLogix 1756-EWEB
# Harmonic Inc. HLT7806R-D7-AS-AC-5, Firmware: 1.3.0. Its a device for optical video transmission.
# Aastra 9133i IP Phone firmware version 1.4.1.1077
# Canon iR2570CI
# Aastra 480i GT
# Scopus IVG-7100 - Intelligent Video Remultiplexer
# WireSpeed Dual Connect DSL Modem
# Westell WireSpeed Dual Connect, model E90-610015-06, software version VER:04.00.00.02
# Sunfire T2000 Service controller
# Avaya T3 IP II.3 Compact (IP Phone), SW Version: T441_0DE.a3i, Bootloader Version: B02.03
# Nortel Ethernet Routing Switch 5520-48T-PWR  HW:32       FW:4.2.0.12  SW:v4.2.0.002
# Philips SOPHO iS3000 PBX system
# [Sun ALOM is VxWorks for sure. --Ed.]
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=96-A6%GCD=1-6%ISR=9B-BF%TI=I%CI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=O%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Apple Airport Express V6.3
# Added another Airport express, no version #
# CANON iR C5185
# Canon iR3045 Laser Printer
# Canon iR5055
# Canon imageRUNNER multifunction printer C3380
# Apple Airport Extreme Base Station. Version 5.7.
# Xerox Phaser 8860MFP
# AMX NI-3100 NetLinx Integrated Controller
# VxWorks based firmware for the AMX NI-4100 NetLinx Integrated Controller
# Nortel Communication Server 1000 PBX
# KYOCERA MITA FS-4020DN printer.
# Canon imageRUNNER multifunction printer C10221
# Dell 3130cn Color Laser, Firmware Version 200903231111, Network Firmware Version 13.161
# Xerox Phaser 8560DN
# Kyocera Mita FS-1350DN
# IBM DS3950 storage
# Kyocera FS-1370DN
Fingerprint VxWorks
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=D1-110%GCD=1-6%ISR=F7-111%TI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Internal NIC on HP LaserJet 2035
# HP Color LaserJet CM2320fxiMFP
# HP Color LaserJet CM1312nfi MFP
# HP CP1515N
# Network printer HP LaserJet M1120n MFP
# HP LaserJet M1522n MFP
# HP Color LaserJet CP1518ni
# HP LaserJet M1522nf MFP
# HP Color LaserJet CP2025dn, Firmware Datecode: 20081216
# HP LaserJet M1120n network printer
# HP LaserJet P2035n Firmware Datecode 20080814
# HP LaserJet M2727nf MFP
# HP Color LaserJet CP1515n
# Deskjet 3050 All-in-One J610a
# smb-os-discovery: OS: VxWorks (NQ 4.32)
# Digi wireless gateway interfaces Digi X-Grid used by the power company and home thermostat(s).
# HP Color Laserjet 1312NFI (all in one printer)
# HP Photosmart eStation C510a all-in-one printer.
# Photosmart B110a
# HP Officejet 6500
# HP Officejet Pro 8600 N911g
# HP Color LaserJet CP2025dn (VxWorks?)
# HP LaserJet P2035n.
# Vocality BASICS 4-Wire running VOS 8.0
# HP LaserJet M2727nf MFP
# HP LaserJet M27227
# HP LaserJet P1505n
Fingerprint VxWorks: HP printer or Vocality BASICS Four Wire VoIP gateway
Class Wind River | VxWorks || general purpose
CPE cpe:/o:windriver:vxworks auto
Class HP | embedded || printer
Class Vocality | embedded || VoIP adapter
SEQ(SP=79-E1%GCD=1-6%ISR=8D-D5%TI=I|RD|RI%CI=I|RD|RI%II=I|RI%SS=S%TS=7|A|B)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2088%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2238%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Brother HL-23xxDL printer
Fingerprint Brother printer (VxWorks)
Class Wind River | VxWorks || printer
CPE cpe:/o:windriver:vxworks auto
SEQ(SP=103-10D%GCD=1-6%ISR=105-10F%TI=RD%CI=I%TS=9|A)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2088%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2238%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# SB5100E-2.3.2.3-SCM00-NOSH
# HP Procurve 2650 Switch Model HP J4899A
Fingerprint HP LaserJet 3600 printer, HP ProCurve 2650 switch, or Motorola SURFboard SB5100E cable modem
Class Wind River | VxWorks || printer
CPE cpe:/o:windriver:vxworks auto
Class HP | embedded || printer
CPE cpe:/h:hp:laserjet_3600 auto
Class HP | embedded || switch
CPE cpe:/h:hp:procurve_2650
Class Motorola | embedded || broadband router
CPE cpe:/h:motorola:surfboard_sb5100e auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I|RD%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Dell PowerVault MD3200i
# Dell Powervault Modular Disk Storage Manager
Fingerprint Dell PowerVault MD3200i SAN
Class Wind River | VxWorks || storage-misc
CPE cpe:/o:windriver:vxworks auto
Class Dell | embedded || storage-misc
SEQ(SP=90-A4%GCD=1-6%ISR=99-AB%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# 3Com NBX 100. VxWorks: http://www.3com.com/products/en_US/detail.jsp?tab=features&pathtype=purchase&sku=WEBBNGNBX100COMSYS
Fingerprint 3Com NBX 100 VoIP adapter (VxWorks)
Class Wind River | VxWorks || VoIP adapter
CPE cpe:/o:windriver:vxworks auto
Class 3Com | embedded || VoIP adapter
CPE cpe:/h:3com:nbx_100
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5C2NW0NNT11%O2=M5C2NW0NNT11%O3=M5C2NW0NNT11%O4=M5C2NW0NNT11%O5=M5C2NW0NNT11%O6=M5C2NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5C2NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=O%A=O%F=A%O=NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=2000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Netgear HE102 Wireless 802.11a AccessPoint with VxWorks embedded OS
Fingerprint Netgear HE102 WAP (VxWorks)
Class Wind River | VxWorks || WAP
CPE cpe:/o:windriver:vxworks auto
Class Netgear | embedded || WAP
CPE cpe:/h:netgear:he102 auto
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9A-A4%II=I%TS=U)
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=N)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Tenda W311R+ Wireless router
Fingerprint Tenda W311R+ WAP (VxWorks)
Class Wind River | VxWorks || WAP
CPE cpe:/o:windriver:vxworks auto
Class Tenda | embedded || WAP
CPE cpe:/h:tenda:w311r%2b
SEQ(SP=101-10B%GCD=1-6%ISR=FD-113%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# WIZnet W3150A, a "Fully Hardwired TCP/IP Chip" that exposes a 4-socket TCP/IP stack to the host as a series of memory-mapped registers.
Fingerprint WIZnet W3150A TCP/IP chip
Class WIZnet | embedded || specialized
CPE cpe:/h:wiznet:w3150a
SEQ(R=N)
OPS(O1=M5B4%O2=%O3=%O4=%O5=%O6=)
WIN(W1=800%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0|800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0|800%S=A%A=S+%F=R|AS%O=|M109%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
U1(DF=Y%T=7B-85%TG=80%IPL=38%UN=5DC%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Sonicview Ihub with version 1.4 rom
# Arduino board and optional ethernet shield based on Wiznet W5100 chip. Mac address DEADBE.
# arduino uno + ethernet shield + standard ipv4 ethernet lib + a simple webserver
Fingerprint WIZnet W5100 TCP/IP chip
Class WIZnet | embedded || specialized
CPE cpe:/h:wiznet:w5100
SEQ(SP=40-84%GCD=1-6%ISR=C0-CA%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4%O5=M218%O6=M109)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=800%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=800%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
U1(DF=Y%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# W5100 in Arduino Ethernet shield. MAC address DEADBE. http://www.arduino.cc/en/Main/ArduinoEthernetShield
Fingerprint WIZnet W5100 TCP/IP chip
Class WIZnet | embedded || specialized
CPE cpe:/h:wiznet:w5100
SEQ(R=N)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0%O=%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=A%A=O%F=R%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)
U1(DF=Y%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Arduino-compatible EtherTen, produced by Freetronics. http://www.freetronics.com/products/etherten. "the same Wiznet W5100 chip used by the official Arduino Ethernet Shield"
# Arduino with Ethernet Shield, using Ethernet Library (www.arduino.cc)
Fingerprint WIZnet W5100 TCP/IP chip
Class WIZnet | embedded || specialized
CPE cpe:/h:wiznet:w5100
SEQ(SP=5D-D3%GCD=1-6%ISR=C0-CA%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M5B4)
WIN(W1=800%W2=800%W3=800%W4=800%W5=0%W6=0)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=0%CC=N)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=O|S+%F=AS%RD=0)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
T3(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
T5(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
T6(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
T7(R=Y%DF=Y%T=7B-85%TG=80%W=0%S=A%A=O%F=R%RD=0)
U1(DF=Y%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# WowWee Rovio UI v3.97 | Evo v4.72b.201 http://www.wowwee.com/en/support/rovio, runs eCos on a 200MHz ARM9 processor, according to coverage on DeviceGuru
Fingerprint WowWee Rovio mobile webcam
Class WowWee | embedded || webcam
CPE cpe:/h:wowwee:rovio
SEQ(SP=92-A0%GCD=1-6%ISR=98-A4%II=I%TS=1)
OPS(O1=M5A8NW0NNT11%O2=M5A8NW0NNT11%O3=M5A8NW0NNT11%O4=M5A8NW0NNT11%O5=M5A8NW0NNT11%O6=M5A8NNT11)
WIN(W1=9310%W2=9264%W3=90BC%W4=9310%W5=9154%W6=904A)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=9448%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=904A%S=O%A=S+%F=AS%O=M5A8NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=9000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=3401%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# WowWee Rovio robot/webcam, running modified centos
Fingerprint WowWee Rovio mobile webcam
Class WowWee | embedded || webcam
CPE cpe:/h:wowwee:rovio
SEQ(SP=93-CD%GCD=1-6%ISR=9A-C4%TI=I|RD%CI=I%II=I%SS=S%TS=1|3)
OPS(O1=M198NW0NNT11%O2=M198NW0NNT11%O3=M198NW0NNT11%O4=M198NW0NNT11%O5=M198NW0NNT11%O6=M198NNT11)
WIN(W1=9108%W2=9108%W3=9108%W4=9108%W5=9108%W6=904A)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=9060%O=M1A4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=904A%S=O%A=S+%F=AS%O=M198NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=9000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=3401%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Dell Wyse P25 zero client
Fingerprint Wyse P class PCoIP client
Class Wyse | embedded || terminal
SEQ(SP=FE-10A%GCD=1-6%ISR=103-10D%TI=RI%II=I%SS=S%TS=A)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=21F0%W2=2088%W3=2258%W4=21F0%W5=20C0%W6=209D)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2238%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Wyse V10L thin client
# Wyse 1200LE running Wyse "Thin OS" (Blazer) firmware version 5.2.0_39
Fingerprint Wyse V10L or 1200LE thin client
Class Wyse | embedded || terminal
CPE cpe:/h:wyse:v10l
CPE cpe:/h:wyse:v1200le
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=9A-A4%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NNLL%O2=M5B4NNLL%O3=M5B4NNLL%O4=M5B4NNLL%O5=M5B4NNLL%O6=M5B4NNLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%O=M5B4NNLL%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse V10L Thin Client running Wyse Thin OS
Fingerprint Wyse V10L thin client
Class Wyse | embedded || terminal
CPE cpe:/h:wyse:v10l
SEQ(SP=8E-98%GCD=1-6%ISR=9A-A4%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NNLL%O2=M5B4NNLL%O3=M5B4NNLL%O4=M5B4NNLL%O5=M5B4NNLL%O6=M5B4NNLL)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%O=M5B4NNLL%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse ThinOS 5.2
Fingerprint Wyse ThinOS 5.2
Class Wyse | ThinOS | 5.X | terminal
CPE cpe:/o:wyse:thinos:5.2 auto
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# thin client Wyse Model SX0
# Wyse S10 Thin Client
# Wyse Winterm 1200 LE terminal
# Wyse ThinOS 6.5.0_22
# Thin Client Wyse Xenith
# Wyse C10LE
Fingerprint Wyse C10LE, S10, SX0, 1200LE, or Xenith terminal (ThinOS 6.5)
Class Wyse | ThinOS | 6.X | terminal
CPE cpe:/o:wyse:thinos:6.5 auto
SEQ(SP=90-9A%GCD=1-6%ISR=9D-A7%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse ThinOS 6
Fingerprint Wyse ThinOS 6
Class Wyse | ThinOS | 6.X | terminal
CPE cpe:/o:wyse:thinos:6 auto
SEQ(CI=I%II=I%TS=U)
OPS(R=N)
WIN(R=N)
ECN(R=N)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse ThinOS version 7.1
Fingerprint Wyse ThinOS 7.1
Class Wyse | ThinOS | 7.X | terminal
CPE cpe:/o:wyse:thinos:7.1 auto
SEQ(SP=13-103%GCD=1-6|7A00|F400|16E00|1E800|26200%ISR=90-9A%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse ThinOS 7.1_207
Fingerprint Wyse ThinOS 7.1
Class Wyse | ThinOS | 7.X | terminal
CPE cpe:/o:wyse:thinos:7.1 auto
SEQ(SP=0-96%GCD=1-6|7A00|F400|16E00|1E800|26200%ISR=91-9B%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# ThinOS 8.1
Fingerprint Wyse ThinOS 8.1
Class Wyse | ThinOS | 8.X | terminal
CPE cpe:/o:wyse:thinos:8.1 auto
SEQ(SP=102-10C%GCD=1-6%ISR=104-10E%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M580NNS%O2=M580NNS%O3=M580%O4=M580NNS%O5=M580NNS%O6=M580NNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=FFFF%O=M580NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3A-44%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M580NNS%RD=0%Q=)
T4(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3A-44%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3A-44%TG=40%CD=S)

# Firmware Version 3.4.0 PCoIP Device
Fingerprint Wyse ThinOS PCoIP device
Class Wyse | ThinOS || remote management
CPE cpe:/o:wyse:thinos auto
SEQ(SP=FD-107%GCD=1-6%ISR=108-112%CI=I%TS=A)
OPS(O1=M5B4NW0NNSNNT11%O2=M578NW0NNSNNT11%O3=M280NW0NNT11%O4=M5B4NW0NNSNNT11%O5=M218NW0NNSNNT11%O6=M109NNSNNT11)
WIN(W1=4988%W2=4BE8%W3=4998%W4=4988%W5=49B0%W6=4825)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4A24%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Wyse Model Cx0 System version 1.0.0_20
Fingerprint Wyse Cx0 terminal (ThinOS)
Class Wyse | ThinOS || terminal
CPE cpe:/o:wyse:thinos auto
SEQ(SP=87-91%GCD=1-6%ISR=9A-A4%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=1B-25%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=1B-25%TG=20%W=FFFF%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=7B-85%TG=80%CD=S)

# Wyse ThinOS
Fingerprint Wyse ThinOS
Class Wyse | ThinOS || terminal
CPE cpe:/o:wyse:thinos auto
SEQ(SP=F3-109%GCD=1-6%ISR=F4-10E%TI=Z%II=I%TS=7)
OPS(O1=M564ST11NW6%O2=M564ST11NW6%O3=M564NNT11NW6%O4=M564ST11NW6%O5=M564ST11NW6%O6=M564ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3A-44%TG=40%W=16D0%O=M564NNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3A-44%TG=40%W=0%S=O%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3A-44%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3A-44%TG=40%CD=S)

# Xavi 7001 Modem
Fingerprint XAVi 7001 DSL modem
Class XAVi | embedded || broadband router
CPE cpe:/h:xavi:7001 auto
SEQ(SP=0-5%GCD=61A8|C350|124F8|186A0|1E848|249F0%ISR=8A-94%TI=I%TS=U)
OPS(O1=|M5B4%O2=|M5B4%O3=|M5B4%O4=|M5B4%O5=|M5B4%O6=|M5B4)
WIN(W1=0|1FB0%W2=0|1FB0%W3=0|1FB0%W4=0|1FB0%W5=0|1FB0%W6=0|1FB0)
ECN(R=Y%DF=N|Y%T=3B-3D%TG=40%W=0|1FB0%O=|M5B4%CC=N%Q=)
T1(R=Y%DF=N|Y%T=3B-3D%TG=40%S=O|Z%A=S|S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-3D%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=19-23%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(R=N)

# Device Vendor: XAVi Technologies Corporation Model Number: X7721r+ Device: DSL router
Fingerprint XAVi X7721r+ DSL router
Class XAVi | embedded || broadband router
CPE cpe:/h:xavi:x7721r%2b auto
SEQ(SP=75-8B%GCD=1-6%ISR=7F-8F%TI=I%TS=U)
OPS(O1=M58C%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=4000%O=M58C%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=96-A0%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Xavi Wireless x7868r
Fingerprint XAVi X7868r wireless ADSL modem
Class XAVi | embedded || WAP
CPE cpe:/h:xavi:x7868r auto
SEQ(SP=7F-8B%GCD=1-6%ISR=81-8D%TI=I%TS=U)
OPS(O1=M58C%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=FDE8%W2=FDE8%W3=FDE8%W4=FDE8%W5=FDE8%W6=FDE8)
ECN(R=Y%DF=Y%T=7B-85%TG=80%W=FDE8%O=M58C%CC=N%Q=)
T1(R=Y%DF=Y%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=7B-85%TG=80%W=FDE8%S=A%A=Z%F=R%O=%RD=0%Q=)
T3(R=N)
T4(R=Y%DF=Y%T=7B-85%TG=80%W=FDE8%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=96-A0%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=N)

# Xerox ApeosPort-IV C3370 (Probably VxWorks -- Ed.)
Fingerprint Xerox ApeosPort-IV C3370 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:apeosport-iv_c3370
SEQ(SP=FA-104%GCD=1-6%ISR=105-10F%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=70%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Xerox DC220 printer
Fingerprint Xerox DC220 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:dc220 auto
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Xerox DC440 printer
Fingerprint Xerox Document Centre 440 or WorkCentre Pro 55 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:document_centre_440
CPE cpe:/h:xerox:wordcentre_pro_55
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=4000%W2=4000%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# xerox phaser 3150 printer
Fingerprint Xerox Phaser 3150 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_3150 auto
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=99-A3%TI=I%II=I%SS=S%TS=U)
OPS(O1=%O2=%O3=%O4=%O5=%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3A-44%TG=40%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3A-44%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3A-44%TG=40%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3A-44%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3A-44%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3A-44%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FE%TG=FF%CD=S)

# Xerox Phaser 3320
Fingerprint Xerox Phaser 3320 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_3320 auto
SEQ(SP=98-A2%GCD=1-6%ISR=91-9B%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Xerox Phaser 3435
Fingerprint Xerox Phaser 3435 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_3435 auto
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=NNM5A0SNW0%O2=NNM5A0SNW0%O3=M5A0NW0%O4=NNM5A0SNW0%O5=NNM5A0SNW0%O6=NNM5A0S)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=NNM5A0SNW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Xerox Phaser 6020V_BI
Fingerprint Xerox Phaser 6020V/BI printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_6020v%2fbi
SEQ(SP=80-94%GCD=1-6%ISR=91-9B%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=M5A0NW0%O2=M5A0NW0%O3=M5A0NW0%O4=M5A0NW0%O5=M5A0NW0%O6=M5A0)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2710%O=M5A0NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Phaser 6180N
Fingerprint Xerox Phaser 6180N printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_6180n auto
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=3000%W2=3000%W3=3000%W4=3000%W5=3000%W6=3000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=3000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=3000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=3000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=4E4%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Xerox Phaser 6250DP
Fingerprint Xerox Phaser 6250DP printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_6250dp auto
SEQ(SP=14-1E%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=99-A3%TI=I%CI=RD%II=I%SS=S%TS=U)
OPS(O1=M200NW0%O2=M200NW0%O3=M200NW0%O4=M200NW0%O5=M200NW0%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M200NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=3B-45%TG=40%W=80%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=100%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=400%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=7A69%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=8000%S=A%A=S+%F=AR%O=WANM109T10S%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=FFFF%S=A%A=S+%F=AR%O=WFNM109T10S%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Phaser 6600DN
Fingerprint Xerox Phaser 6600DN printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_6600dn auto
SEQ(SP=96-A0%GCD=1-6%ISR=95-9F%TI=BI%CI=BI%II=BI%SS=S%TS=U)
OPS(O1=NNM592SNW0%O2=NNM592SNW0%O3=M592NW0%O4=NNM592SNW0%O5=NNM592SNW0%O6=NNM592S)
WIN(W1=2710%W2=2710%W3=2710%W4=2710%W5=2710%W6=2710)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2710%O=NNM592SNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=Z%F=R%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=138%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=Z)

# Xerox Phaser 860N
# Operating system: 3.38; Networking  12.86.04.06.2001
# Xerox Phaser 8200N
Fingerprint Xerox Phaser 860N or 8200N printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:phaser_860n
CPE cpe:/h:xerox:phaser_8200n
SEQ(SP=0-5%GCD=186A0|30D40|493E0|61A80|7A120|927C0%ISR=9A-A4%TI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M578%O3=M280%O4=M218%O5=M218%O6=M109)
WIN(W1=B68%W2=AF0%W3=F00%W4=EA8%W5=EA8%W6=F87)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=B68%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=7B-85%TG=80%W=FFFF%S=O%A=O%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# Xerox WorkCentre device printer - http://www.office.xerox.com/latest/W50BR-01.PDF
Fingerprint Xerox WorkCentre 4150 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:workcentre_4150 auto
SEQ(SP=E-18%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=1000%O=%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=O|S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# XEROX WorkCentre 7545
Fingerprint Xerox WorkCentre 7545 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:workcentre_7545 auto
SEQ(SP=F5-FF%GCD=1-6%ISR=106-110%TI=Z%CI=Z%II=I%TS=8|9)
OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11NW5%O5=M5B4ST11NW5%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW5%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Xerox WorkCentre 7245
Fingerprint Xerox WorkCentre Pro 7245 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:workcentre_pro_7245
SEQ(SP=95-9F%GCD=1-6%ISR=9B-A5%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=2000%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Xerox WorkCentre Pro C2128, v1 Multifunction System
Fingerprint Xerox WorkCentre Pro C2128 printer
Class Xerox | embedded || printer
CPE cpe:/h:xerox:workcentre_pro_c2128
SEQ(SP=C-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=4000%W2=4000%W3=4100%W4=4000%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=402E%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=15C%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# eComStation 2.2 (IBM OS/2)
Fingerprint eComStation 2.2
Class XEU.com | eComStation | 2.X | general purpose
CPE cpe:/o:xeu.com:ecomstation:2.2 auto
SEQ(SP=91-9B%GCD=1-6%ISR=90-9A%TI=I|RD%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=FE88%W2=FED4%W3=FCAC%W4=FBF4%W5=FBC4%W6=FB06)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=FAF0%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=4210%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Xirrus XS8 Wi-Fi Array, System software 3.5 (Feb 23 2009), Build: 0706
# Xirrus XS8, System Software version 3.5, Build 0724
# Xirrus Wi-Fi Array ArrayOS Version 3.3-0550
# Linux-based: http://www.xirrus.com/Products/Array-OS.aspx
Fingerprint Xirrus XS8 WAP (Array OS 3.3 - 3.5)
Class Xirrus | ArrayOS | 3.X | WAP
CPE cpe:/h:xirrus:xs8
SEQ(SP=BE-D0%GCD=1-6%ISR=C5-D5%TI=Z%CI=I%II=I%TS=A)
OPS(O1=M5B8ST11NW2%O2=M5B8ST11NW2%O3=M5B8NNT11NW2%O4=M5B8ST11NW2%O5=M5B8ST11NW2%O6=M5B8ST11)
WIN(W1=16B0%W2=16B0%W3=16B0%W4=16B0%W5=16B0%W6=16B0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1128%O=M5B8NNSNW2%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16B0%S=O%A=S+%F=AS%O=M5B8ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# XMOS (www.xmos.com) XC-2 development card for their XS1G4 multicore multithreaded processor.
Fingerprint XMOS XC-2 development card
Class XMOS | embedded || specialized
CPE cpe:/h:xmos:xc-2
SEQ(SP=0-29%GCD=1-6|BC|CC|178|198|234|264|2F0|330|3AC|3FC%ISR=52-5C%TI=I%II=RI%SS=O%TS=U)
OPS(O1=M80%O2=M80%O3=M80%O4=M80%O5=M80%O6=M80)
WIN(W1=1C0%W2=1C0%W3=1C0%W4=1C0%W5=1C0%W6=1C0)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%O=M80%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%S=O%A=S+%F=AS%O=M80%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=1C0%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=2591|2B68|3164|3793|3DEA%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Xylan OmniStack OS-4024CF running Version 3.4.2
Fingerprint Xylan OmniStack 4024CF switch
Class Xylan | embedded || switch
CPE cpe:/h:xylan:omnistack_4024cf auto
SEQ(SP=0-16%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=97-A1%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=1000%W2=1000%W3=1000%W4=1000%W5=1000%W6=1000)
ECN(R=Y%DF=N%T=19-23%TG=20%W=1000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=19-23%TG=20%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=19-23%TG=20%W=1000%S=O%A=O%F=A%O=%RD=0%Q=)
T4(R=Y%DF=N%T=19-23%TG=20%W=1000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=1B-25%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=0%RUD=G)
IE(DFI=S%T=1B-25%TG=20%CD=S)

# Xylan OmniStack! Version 3.2.5
Fingerprint Xylan OmniStack switch (version 3.2.5)
Class Xylan | embedded || switch
CPE cpe:/h:xylan:omnistack
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT00NNS%O2=M5B4NW0NNT00NNS%O3=M5B4NW0NNT00%O4=M5B4NW0NNT00NNS%O5=M5B4NW0NNT00NNS%O6=M5B4NNT00NNS)
WIN(W1=4470%W2=41A0%W3=4100%W4=40E8%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=7C-86%TG=80%W=4470%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=7C-86%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=1B-25%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=6A1D%RUD=G)
IE(DFI=S%T=1B-25%TG=20%CD=S)

# Xylan OmniStack! Version 3.4.7
Fingerprint Xylan OmniStack switch (version 3.4.7)
Class Xylan | embedded || switch
CPE cpe:/h:xylan:omnistack
SEQ(SP=FF-109%GCD=1-6%ISR=104-10E%TI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT00NNS%O2=M5B4NW0NNT00NNS%O3=M5B4NW0NNT00%O4=M5B4NW0NNT00NNS%O5=M5B4NW0NNT00NNS%O6=M5B4NNT00NNS)
WIN(W1=4470%W2=41A0%W3=4100%W4=40E8%W5=40E8%W6=402E)
ECN(R=Y%DF=N%T=7C-86%TG=80%W=4470%O=M5B4NW0NNS%CC=N%Q=)
T1(R=Y%DF=N%T=7C-86%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=19-23%TG=20%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=19-23%TG=20%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=1B-25%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=I%RUCK=3D87%RUD=G)
IE(DFI=S%T=1B-25%TG=20%CD=S)

# Xyplex Terminal Server
Fingerprint Xyplex terminal server
Class Xyplex | embedded || terminal server
SEQ(CI=I%II=I%TS=U)
OPS(O1=M100%O2=%O3=%O4=%O5=%O6=)
WIN(W1=100%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=%CC=S%Q=RU)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=UAPRF%O=%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S+%F=UAPRF%O=%RD=0%Q=)
U1(R=N)
IE(DFI=N%T=3B-45%TG=40%CD=Z)

# Model: RX-A2040, Firmware: 1.66/1.4
Fingerprint Yamaha RX-A2040 AV receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-a2040
SEQ(SP=C-16%GCD=FA7F|1F4FE|2EF7D|3E9FC|4E47B%ISR=97-A1%TI=I|RD%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=FFFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=7B-85%TG=80%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=7B-85%TG=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=7B-85%TG=80%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=7B-85%TG=80%CD=S)

# AV-Receiver RX-V2065
Fingerprint Yamaha RX-V2065 audio/video receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-v2065
SEQ(SP=F1-103%GCD=1-6%ISR=FE-10A%TI=Z%CI=Z%II=RI%TS=U)
OPS(O1=M578%O2=M578%O3=M280%O4=M578%O5=M218%O6=M109)
WIN(W1=E998%W2=E998%W3=E998%W4=E998%W5=E998%W6=E998)
ECN(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%O=M578%CC=N%Q=)
T1(R=Y%DF=Y%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%S=O%A=S+%F=AS%O=M109%RD=0%Q=)
T4(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=FA-104%TG=FF%W=E998%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=Y%T=FA-104%TG=FF%IPL=38%UN=6D6C%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=23-3D%TG=40%CD=S)

# Yamaha Network capable audio receiver, model RX-V3900
# Yamaha Aventage receiver
# Web Control Center of AV-Receiver Yamaha RX-V2067
Fingerprint Yamaha RX-V2067 or RX-V3900 audio receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-v2067
CPE cpe:/h:yamaha:rx-v3900
SEQ(CI=RD|RI%II=RI%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=0%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=3B-45%TG=40%W=0%S=O%A=O%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Yamaha RX-V481D (TI chip, looks like Linux, -ed)
Fingerprint Yamaha RX-V481D AV receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-v481d
SEQ(SP=101-10B%GCD=1-6%ISR=108-112%TI=Z%CI=Z%II=I%TS=6)
OPS(O1=M5B4ST11NW2%O2=M5B4ST11NW2%O3=M5B4NNT11NW2%O4=M5B4ST11NW2%O5=M5B4ST11NW2%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW2%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW2%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# AV Receiver RX-V671
Fingerprint Yamaha RX-V671 AV receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-v671
SEQ(SP=78-82%GCD=1-6%ISR=BA-C4%TI=I%CI=I%II=RI%SS=S%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=7FFF%W2=7FFF%W3=7FFF%W4=7FFF%W5=7FFF%W6=7FFF)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=D0A%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Yamaha RX-V671 Receiver
Fingerprint Yamaha RX-V671 AV receiver
Class Yamaha | embedded || media device
CPE cpe:/h:yamaha:rx-v671
SEQ(SP=0-5%GCD=49CA53|9394A6|DD5EF9|127294C|170F39F%ISR=C7-D1%TI=I%CI=I%TS=U)
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
WIN(W1=7FFF%W2=7FFF%W3=7FFF%W4=7FFF%W5=7FFF%W6=7FFF)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=O%A=S+%F=AS%O=M5B4%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A+%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=7FFF%S=A%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=S%T=FA-104%TG=FF%CD=S)

# Yamaha Router Model: RT5 7i
Fingerprint Yamaha NetVolante RT57i router
Class Yamaha | embedded || router
CPE cpe:/h:yamaha:netvolante_rt57i auto
SEQ(SP=F7-101%GCD=1-6%ISR=FC-106%TI=I%CI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=3C-46%TG=40%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=N%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3C-46%TG=40%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3C-46%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3C-46%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3C-46%TG=40%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3C-46%TG=40%CD=S)

# Router YAMAHA NETVOLANTE RT58i Rev.9.01.13
# RT107e
Fingerprint Yamaha RT58i or RT107e router
Class Yamaha | embedded || router
CPE cpe:/h:yamaha:netvolante_rt58i auto
SEQ(SP=F1-103%GCD=1-6%ISR=FE-10E%TI=I%II=I%SS=S%TS=7)
OPS(O1=M5B4NW1NNT11%O2=M5B4NW1NNT11%O3=M5B4NW1NNT11%O4=M5B4NW1NNT11%O5=M5B4NW1NNT11%O6=M5B4NNT11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
ECN(R=Y%DF=N%T=100%TG=FF%W=FFFF%O=M5B4NW1%CC=N%Q=)
T1(R=Y%DF=N%T=100%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=100%TG=FF%W=FFFF%S=O%A=S+%F=AS%O=M5B4NW1NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=100%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=100%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=100%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=100%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=100%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=100%TG=FF%CD=S)

# Yealink Enterprise IP phone SIP-T22P
Fingerprint Yealink SIP-T22P VoIP phone
Class Yealink | embedded || VoIP phone
CPE cpe:/h:yealink:sip-t22p auto
SEQ(SP=102-10C%GCD=1-6%ISR=109-113%TI=Z%CI=RI%II=I%TS=7)
OPS(O1=M566ST11NW1%O2=M566ST11NW1%O3=M280NNT11NW1%O4=M22CST11NW1%O5=M218ST11NW1%O6=M109ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3C-46%TG=40%W=16D0%O=M566NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3C-46%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3C-46%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3C-46%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3C-46%TG=40%CD=S)

# Zebra Technologies ZTC GK420t Internal Wired PrintServer
Fingerprint Zebra GK420t label printer
Class Zebra | embedded || printer
SEQ(SP=63-6D%GCD=1000|2000|3000|4000|5000%ISR=BA-C4%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4T11NN%O2=M5B4T11NN%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4T11NN%O6=M5B4T11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=37-41%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=70%UN=FBB3%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# ZTC GK420t
Fingerprint Zebra GK420t label printer
Class Zebra | embedded || printer
CPE cpe:/h:zebra:gk420t
SEQ(SP=78-82%GCD=1000|2000|3000|4000|5000%ISR=CF-D9%TI=I%CI=I%TS=6)
OPS(O1=M550T11NN%O2=M550T11NN%O3=M550T11NN%O4=M550T11NN%O5=M550T11NN%O6=M550T11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=38-42%TG=40%W=16D0%O=M550%CC=N%Q=)
T1(R=Y%DF=N%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=38-42%TG=40%W=16D0%S=O%A=S+%F=AS%O=M550T11NN%RD=0%Q=)
T4(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=38-42%TG=40%IPL=70%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=38-42%TG=40%CD=Z)

# Zebra GX430T Label printer
# Zebra Technologies ZTC GX430t
Fingerprint Zebra GX430T label printer
Class Zebra | embedded || printer
CPE cpe:/h:zebra:gx430t
SEQ(SP=29-67%GCD=1000|2000|3000|4000|5000%ISR=7E-C6%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4T11NN%O2=M5B4T11NN%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4T11NN%O6=M5B4T11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=37-41%TG=40%W=16D0%O=M5B4%CC=N)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=37-41%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=37-41%TG=40%IPL=70%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# Zebra LP 2844-Z Label Printer with integrated ethernet, F/W Version: 7.02 (3111A)
Fingerprint Zebra LP 2844-Z label printer
Class Zebra | embedded || printer
CPE cpe:/h:zebra:lp_2844-z
SEQ(SP=0-5%GCD=0%ISR=0-5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M218%O2=M218%O3=M218%O4=M218%O5=M218%O6=M218)
WIN(W1=5B4%W2=5B4%W3=5B4%W4=5B4%W5=5B4%W6=5B4)
ECN(R=Y%DF=N%T=7B-85%TG=80%W=5B4%O=M218%CC=N%Q=)
T1(R=Y%DF=N%T=7B-85%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=Y%T=1B-25%TG=20%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=7B-85%TG=80%W=5B4%S=O%A=S+%F=AS%O=M218%RD=0%Q=)
T4(R=Y%DF=Y%T=1B-25%TG=20%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=1B-25%TG=20%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=1B-25%TG=20%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Zebra QLn420 v68.19.6Z
Fingerprint Zebra QLn420 mobile printer
Class Zebra | embedded || printer
SEQ(SP=CC-DC%GCD=1-6%ISR=D4-DE%TI=I%CI=I%II=I%SS=S%TS=0)
OPS(O1=M5B4NW0NNT01SNN%O2=M5B4NW0NNT01SNN%O3=M5B4NW0NNT01%O4=M5B4NW0NNT01SNN%O5=M5B4NW0NNT01SNN%O6=M5B4NNT01SNN)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=Y%T=37-41%TG=40%W=2000%O=M5B4NW0SNN%CC=N%Q=)
T1(R=Y%DF=Y%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=Y%T=37-41%TG=40%W=2000%S=O%A=O|S+%F=AS%O=M5B4NW0NNT01SNN|M5B4NW0NNT11SNN%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=O|S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A|O%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=O|S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Zebra Technologies, ZTC S4M-200dpi ZPL
Fingerprint Zebra S4M barcode label printer
Class Zebra | embedded || printer
SEQ(SP=61-6B%GCD=2000|4000|6000|8000|A000%ISR=C0-CA%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5CAT11NN%O2=M5CAT11NN%O3=M5CAT11NN%O4=M5CAT11NN%O5=M5CAT11NN%O6=M5CAT11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=37-41%TG=40%W=16D0%O=M5CA%CC=N%Q=)
T1(R=Y%DF=N%T=37-41%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=37-41%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5CAT11NN%RD=0%Q=)
T4(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=37-41%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=37-41%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=37-41%TG=40%IPL=70%UN=128%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=37-41%TG=40%CD=Z)

# Zebra Technologies ZTC ZM400-300dpi ZPL
Fingerprint Zebra ZTC ZM400 label printer
Class Zebra | embedded || printer
CPE cpe:/h:zebra:ztc_zm400
SEQ(SP=56-60%GCD=1000|2000|3000|4000|5000%ISR=AD-B7%TI=I%CI=I%II=I%SS=S%TS=6)
OPS(O1=M5B4T11NN%O2=M5B4T11NN%O3=M5B4T11NN%O4=M5B4T11NN%O5=M5B4T11NN%O6=M5B4T11NN)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=N%T=38-42%TG=40%W=16D0%O=M5B4T11NN%CC=N)
T1(R=Y%DF=N%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=38-42%TG=40%W=16D0%S=O%A=S+%F=AS%O=M5B4T11NN%RD=0)
T4(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=38-42%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=38-42%TG=40%IPL=70%UN=CAA8%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=38-42%TG=40%CD=Z)

# ZELAX MM-201R-UNI.1, CPU:MPC852, revA, Communication software version 1.2.11
Fingerprint Zelax MM-201R-UNI router
Class Zelax | embedded || router
CPE cpe:/h:zelax:mm-201r-uni auto
SEQ(SP=95-9F%GCD=1-6%ISR=9B-A5%TI=I%II=I%SS=S%TS=1)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=43E0%W2=4110%W3=423C%W4=4074%W5=4180%W6=403D)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4470%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=3B-45%TG=40%W=403D%S=O%A=S+%F=AS%O=M5B4NW0NNT11%RD=0%Q=)
T4(R=Y%DF=N%T=3B-45%TG=40%W=4000%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Zerto VRA (looks like Linux?)
Fingerprint Zerto Virtual Replication Appliance
Class Zerto | embedded || specialized
SEQ(SP=102-10C%GCD=1-6%ISR=105-10F%TI=Z%CI=Z%II=I%TS=8)
OPS(O1=M5ACST11NW5%O2=M5ACST11NW5%O3=M5ACNNT11NW5%O4=M5ACST11NW5%O5=M5ACST11NW5%O6=M5ACST11)
WIN(W1=3840%W2=3840%W3=3840%W4=3840%W5=3840%W6=3840)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=38B8%O=M5ACNNSNW5%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=3840%S=O%A=S+%F=AS%O=M5ACST11NW5%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# (ADSL Router) ZHONE Firmware: 03.01.08 Product Name: 6211-I3-xxx, Software Version: 3-10-02-2100.A2pB024k1.d20h
Fingerprint Zhone 6211-I3 series ADSL2+ modem
Class Zhone | embedded || broadband router
CPE cpe:/h:zhone:6211-i3
SEQ(SP=CA-D4%GCD=1-6%ISR=C8-D2%TI=Z%II=I%TS=8)
OPS(O1=M5ACST11NW7%O2=M5ACST11NW7%O3=M5ACNNT11NW7%O4=M5ACST11NW7%O5=M5ACST11NW7%O6=M5ACST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=B0D8%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Zhone GPON home gateway, sw R4.0.2.566b
Fingerprint Zhone GPON home gateway
Class Zhone | embedded || broadband router
SEQ(SP=C1-CB%GCD=1-6%ISR=C7-D1%TI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NWB%O2=M5B4ST11NWB%O3=M5B4NNT11NWB%O4=M5B4ST11NWB%O5=M5B4ST11NWB%O6=M5B4ST11)
WIN(W1=BAA8%W2=BAA8%W3=BAA8%W4=BAA8%W5=BAA8%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=BC34%O=M5B4NNSNWB%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Firmware 0.9.999.8q
Fingerprint Zipato Zibabox Duo home automation controller
Class Zipato | embedded || specialized
SEQ(SP=BE-C8%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%TS=9)
OPS(O1=M218ST11NW3%O2=M218ST11NW3%O3=M218NNT11NW3%O4=M218ST11NW3%O5=M218ST11NW3%O6=M218ST11)
WIN(W1=1478%W2=1478%W3=1478%W4=1478%W5=1478%W6=1478)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=14F0%O=M218NNSNW3%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1478%S=O%A=S+%F=AS%O=M218ST11NW3%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZKteco F18 Fingerprint Standalone Access Control and Time Attendance System
Fingerprint ZKTeco F18 fingerprint reader
Class ZKTeco | embedded || specialized
SEQ(SP=C5-CF%GCD=1-6%ISR=C8-D2%TI=I|RD%CI=I%II=I%SS=S%TS=7|9)
OPS(O1=M5B4ST11NW0%O2=M578ST11NW0%O3=M280NNT11NW0%O4=M218ST11NW0%O5=M218ST11NW0%O6=M109ST11)
WIN(W1=77C4%W2=7850%W3=7A80%W4=7B88%W5=7B88%W6=7C38)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=77C4%O=M5B4NNSNW0%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=7C38%S=O%A=S+%F=AS%O=M109ST11NW0%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Zonealarm Z100G firewall/router (home version of the Checkpoint UTM-1 Edge), running OS version 8.0.42x
Fingerprint ZoneAlarm Z100G WAP
Class ZoneAlarm | embedded || WAP
CPE cpe:/h:zonealarm:z100g auto
SEQ(SP=BA-CE%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=37%TG=40%W=16D0%O=M5B4NNSNW7%CC=N%Q=)
T1(R=Y%DF=Y%T=37%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZTE ZXV10 | H201 Broadband Router
Fingerprint ZTE ZXV10 H201 ADSL router
Class ZTE | embedded || broadband router
CPE cpe:/h:zte:zxv10_h201
SEQ(SP=C5-CF%GCD=1-6%ISR=CA-D4%TI=Z%CI=Z%II=I%TS=8)
OPS(O1=M550ST11NW1%O2=M550ST11NW1%O3=M550NNT11NW1%O4=M550ST11NW1%O5=M550ST11NW1%O6=M550ST11)
WIN(W1=1510%W2=1510%W3=1510%W4=1510%W5=1510%W6=1510)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1540%O=M550NNSNW1%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1510%S=O%A=S+%F=AS%O=M550ST11NW1%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZTE Verison 4G LTE Wireless
Fingerprint Verizon Jetpack 4G hotspot
Class ZTE | embedded || WAP
SEQ(SP=C-16%GCD=1000|2000|3000|4000|5000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4W0L%O2=M578W0L%O3=M280W0L%O4=M5B4W0L%O5=M218W0L%O6=M109)
WIN(W1=B400%W2=B400%W3=B400%W4=B400%W5=B400%W6=B400)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=B400%O=M5B4W0L%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S%F=AR%O=T00LL%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=B400%S=O%A=S+%F=AS%O=M109W0L%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=T00LL%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=T00LL%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=Z%F=R%O=T00LL%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# Looks like Green Hills RTOS --Ed.
# Zyfer GSync 391-1XX:Rb, 1U GPSDO with a rubidium oscillator. http://zyfer.com/gsync.htm.
Fingerprint Zyfer GSync 391 clock
Class Zyfer | embedded || specialized
CPE cpe:/h:zyfer:gsync_391
SEQ(SP=0-5%GCD=FA01|1F402|2EE03|3E804|4E205%ISR=95-9F%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M5B4NW0%O2=M578NW0%O3=M280NW0%O4=M218NW0%O5=M218NW0%O6=M109)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=2000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=Z)

# Zyxel AES100
Fingerprint ZyXEL AES-100 ADSL modem
Class ZyXEL | embedded || broadband router
CPE cpe:/h:zyxel:aes-100 auto
SEQ(SP=0-5%GCD=61A8|C350|124F8|186A0|1E848%ISR=8A-94%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=MFD8%O2=MFD8%O3=MFD8%O4=MFD8%O5=MFD8%O6=MFD8)
WIN(W1=1FB0%W2=1FB0%W3=1FB0%W4=1FB0%W5=1FB0%W6=1FB0)
ECN(R=Y%DF=N%T=38-42%TG=40%W=1FB0%O=MFD8%CC=N%Q=)
T1(R=Y%DF=N%T=38-42%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=38-42%TG=40%W=1FB0%S=O%A=S+%F=AS%O=MFD8%RD=0%Q=)
T4(R=Y%DF=Y%T=38-42%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=38-42%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=38-42%TG=40%W=0%S=A%A=S%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=38-42%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=1A-24%TG=20%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=1A-24%TG=20%CD=Z)

# o2 HomeBox 6641
Fingerprint ZyXEL o2 HomeBox 6641 router
Class ZyXEL | embedded || broadband router
CPE cpe:/h:zyxel:o2_homebox_6641 auto
SEQ(SP=C3-CD%GCD=1-6%ISR=C3-CD%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M5B4NNT11%O2=M5B4NNT11%O3=M5B4NNT11%O4=M5B4NNT11%O5=M5B4NNT11%O6=M5B4NNT11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZyXEL Model P-2602H-D1A broadband router
Fingerprint ZyXEL P-2602H-D1A DSL modem
Class ZyXEL | embedded || broadband router
CPE cpe:/h:zyxel:p-2602h-d1a auto
SEQ(SP=0-16%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%CI=RI%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=400%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=3B-45%TG=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# Zyxel Prestige 660R-61C ADSL router
Fingerprint ZyXEL Prestige 660R ADSL router
Class ZyXEL | embedded || broadband router
CPE cpe:/h:zyxel:prestige_660r auto
SEQ(CI=I%II=I%TS=U)
OPS(O1=M200%O2=|M200%O3=%O4=%O5=%O6=)
WIN(W1=400%W2=0|800%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0%O=%CC=Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=O%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# Router Zyxel Keenetic 4G
Fingerprint Zyxel Keenetic 4G router
Class ZyXEL | embedded || router
CPE cpe:/h:zyxel:keenetic_4g auto
SEQ(SP=BF-C9%GCD=1-6%ISR=C8-D2%TI=Z%CI=Z%TS=A)
OPS(O1=M51EST11NW6%O2=M51EST11NW6%O3=M51ENNT11NW6%O4=M51EST11NW6%O5=M51EST11NW6%O6=M51EST11)
WIN(W1=1448%W2=1448%W3=1448%W4=1448%W5=1448%W6=1448)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1478%O=M51ENNSNW6%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=1448%S=O%A=S+%F=AS%O=M51EST11NW6%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZyXEL NSA220
Fingerprint ZyXEL NSA-200 NAS device
Class ZyXEL | embedded || storage-misc
CPE cpe:/h:zyxel:nsa-200 auto
SEQ(SP=C9-D3%GCD=1-6%ISR=CA-D4%TI=Z%II=I%TS=7)
OPS(O1=M550ST11NW1%O2=M550ST11NW1%O3=M550NNT11NW1%O4=M550ST11NW1%O5=M550ST11NW1%O6=NNT11|M550ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M550NNSNW1%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZyXEL NSA210 I read that it runs Linux 2.6
Fingerprint ZyXEL NSA-210 NAS device
Class ZyXEL | embedded || storage-misc
CPE cpe:/h:zyxel:nsa-210 auto
SEQ(SP=BD-C7%GCD=1-6%ISR=C2-CC%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M2300ST11NW2%O2=M2300ST11NW2%O3=M2300NNT11NW2%O4=M2300ST11NW2%O5=M2300ST11NW2%O6=M2300ST11)
WIN(W1=45E8%W2=45E8%W3=45E8%W4=45E8%W5=45E8%W6=45E8)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=4600%O=M2300NNSNW2%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=45E8%S=O%A=S+%F=AS%O=M2300ST11NW2%RD=0)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%RD=0)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%RD=0)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A|O%A=Z%F=R%RD=0)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=O|S+%F=AR%RD=0)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Linux NSA320S 2.6.31.8 #2 Mon Mar 14 13:51:43 CST 2016 armv5tel GNU/Linux
Fingerprint ZyXEL NSA320S NAS (Linux 2.6.31)
Class ZyXEL | embedded || storage-misc
CPE cpe:/h:zyxel:nsa320s
Class Linux | Linux | 2.6.X | general purpose
CPE cpe:/o:linux:linux_kernel:2.6.31 auto
SEQ(SP=C1-CB%GCD=1-6%ISR=C7-D1%TI=Z%CI=Z%II=I%TS=7)
OPS(O1=M23D8ST11NW4%O2=M23D8ST11NW4%O3=M23D8NNT11NW4%O4=M23D8ST11NW4%O5=M23D8ST11NW4%O6=M23D8ST11)
WIN(W1=4798%W2=4798%W3=4798%W4=4798%W5=4798%W6=4798)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=47B0%O=M23D8NNSNW4%CC=Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=4798%S=O%A=S+%F=AS%O=M23D8ST11NW4%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Zyxel ES-3024A switch
Fingerprint ZyXEL ES-3024A switch
Class ZyXEL | embedded || switch
CPE cpe:/h:zyxel:es-3024a auto
SEQ(SP=0-1D%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FE%TG=FF%W=4000%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=4000%S=O%A=O|S+%F=AS%O=M578%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# GS1910-24 switch, Software Version V1.00(AAAX.4), Software Date  2013-09-16
Fingerprint ZyXEL GS1910 switch
Class ZyXEL | embedded || switch
CPE cpe:/h:zyxel:gs1910 auto
SEQ(SP=FC-106%GCD=1-6%ISR=102-10C%TI=I%TS=7)
OPS(O1=M5B4NW0NNT11%O2=M5B4NW0NNT11%O3=M5B4NW0NNT11%O4=M5B4NW0NNT11%O5=M5B4NW0NNT11%O6=M5B4NNT11)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=3B-45%TG=40%W=4000%O=M5B4NW0%CC=N%Q=)
T1(R=Y%DF=N%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=38%UN=0%RIPL=G%RID=B18B%RIPCK=G%RUCK=0%RUD=G)
IE(DFI=S%T=3B-45%TG=40%CD=S)

# Zyxel Keenetyc Giga, release: v2.04(USD.1)C6
# Keenetic Extra NDMS v2.05(AANS.5)C2
# NDMS v2.05(AAFS.5)C2
# ZyXEL Keenetic NDMS v2.05(AAGJ.0)C4
Fingerprint ZyXEL Keenetic Giga WAP 2.04 - 2.05
Class ZyXEL | embedded || WAP
SEQ(SP=C6-E8%GCD=1-6%ISR=CD-DD%TI=Z%CI=Z%II=I%TS=7|A)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=16A0%W2=16A0%W3=16A0%W4=16A0%W5=16A0%W6=16A0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW6%CC=N|Y%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=Y%T=3B-45%TG=40%W=16A0%S=O%A=S+%F=AS%O=M5B4ST11NW6%RD=0%Q=)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Linux NBG6817 3.4.103 #2 SMP PREEMPT Tue Apr 26 18:09:38 CST 2016 armv7l GNU/Linux
Fingerprint ZyXEL NBG6817 WAP (Linux 3.4)
Class ZyXEL | embedded || WAP
CPE cpe:/h:zyxel:nbg6817 auto
Class Linux | Linux | 3.X | general purpose
CPE cpe:/o:linux:linux_kernel:3.4 auto
SEQ(SP=FA-104%GCD=1-6%ISR=106-110%TI=Z%CI=I|RI%II=RI%TS=7)
OPS(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST11NW6%O6=M5B4ST11)
WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=3908%O=M5B4NNSNW6%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Zywall USG 20 router/VPN gateway. Firmware version: 3.30(BDQ.7) / 1.15 / 2015-01-13 16:28:21
Fingerprint ZyWALL Unified Security Gateway (ZLD 3.30)
Class ZyXEL | ZLD | 3.X | security-misc
CPE cpe:/o:zyxel:zld:3.30 auto
SEQ(SP=C2-CC%GCD=1-6%ISR=C3-CD%TI=Z%II=I%TS=U)
OPS(O1=M550NNSNW4%O2=M550NNSNW4%O3=M550NW4%O4=M550NNSNW4%O5=M550NNSNW4%O6=M550NNS)
WIN(W1=1540%W2=1540%W3=1540%W4=1540%W5=1540%W6=1540)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=1540%O=M550NNSNW4%CC=N%Q=)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# Zywall USG 50 Current Firmware Version: 2.21(BDS.4)
# ZyWALL USG 20
# Zyxel ZyWall USG 20, Firmware: ZLD 3.30(BDQ.7)
Fingerprint ZyXEL ZyWALL USG 20 or USG 50 firewall (ZyNOS 2.21)
Class ZyXEL | ZyNOS | 2.X | firewall
CPE cpe:/o:zyxel:zynos:2.21 auto
SEQ(SP=BC-D0%GCD=1-6%ISR=C3-D9%TI=Z%II=I%TS=U)
OPS(O1=M5B4NNSNW4%O2=M5B4NNSNW4%O3=M5B4NW4%O4=M5B4NNSNW4%O5=M5B4NNSNW4%O6=M5B4NNS)
WIN(W1=16D0%W2=16D0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)
ECN(R=Y%DF=Y%T=3B-45%TG=40%W=16D0%O=M5B4NNSNW4%CC=N)
T1(R=Y%DF=Y%T=3B-45%TG=40%S=O%A=S+%F=AS%RD=0)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=Y%T=3B-45%TG=40%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=N)
T7(R=N)
U1(DF=N%T=3B-45%TG=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=3B-45%TG=40%CD=S)

# ZyXEL Prestige 202 DSS1, ZyNOS version: V2.41(N.01) | 12/20/1999, bootbase version: V1.13 | 4/14/2000
Fingerprint ZyXEL Prestige 202 ISDN router (ZyNOS 2.41)
Class ZyXEL | ZyNOS | 2.X | router
CPE cpe:/o:zyxel:zynos:2.41 auto
SEQ(SP=0-5%GCD=6C000|D8000|144000|1B0000|21C000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
WIN(W1=0|2000%W2=0|2000%W3=0|2000%W4=0|2000%W5=0|2000%W6=0|2000)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0|2000%O=|M200%CC=N|Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=2000%S=O%A=O|S+%F=AS%O=M200%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# G-2000PLUS ZyNOS Firmware Version: V3.60(HU.4) | 06/01/2006
Fingerprint ZyXEL G-2000 Plus WAP
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3 auto
SEQ(SP=0-16%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M400%O2=M400%O3=M400%O4=M400%O5=M400%O6=M400)
WIN(W1=4000%W2=4000%W3=4000%W4=4000%W5=4000%W6=4000)
ECN(R=Y%DF=N%T=FE%TG=FF%W=4000%O=M400%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# P-2602HW-D1A, ZyNOS F/W Version: V3.40(ADQ.4)b1_IPPR_0307 | 03/07/2007
Fingerprint ZyXEL P-2602HW-D1A wireless DSL modem (ZyNOS 3.40)
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3.40 auto
SEQ(SP=D-17%GCD=A000|14000|1E000|28000|32000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M546%O2=M546%O3=M546%O4=M546%O5=M546%O6=M546)
WIN(W1=5500%W2=5500%W3=5500%W4=5500%W5=5500%W6=5500)
ECN(R=Y%DF=N%T=FE%TG=FF%W=5500%O=M546%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# Zyxel Prestige 200 ISDN router
Fingerprint ZyXEL Prestige 200 ISDN router
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3 auto
SEQ(SP=1B-25%GCD=1000|2000|3000|4000|5000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=F9-103%TG=FF%W=2000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# Model Number:  P-2602R-D1A - Firmware Version: V3.40(AJP.0) | 04/29/2008 - DSL Firmware Version:  TI AR7 07.00.02.00
Fingerprint ZyXEL Prestige 2602R-D1A ADSL router (ZyNOS 3.40)
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3.40
CPE cpe:/h:zyxel:prestige_2602r-d1a
SEQ(SP=0-5%GCD=64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I|RD%CI=I%II=I%SS=O|S%TS=U)
OPS(O1=M550%O2=M550%O3=M550%O4=M550%O5=M550%O6=M550)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=F9-103%TG=FF%W=800%O=M550%CC=N)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=O|S+%F=AS%RD=0)
T2(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%RD=0)
T3(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T4(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%RD=0)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%RD=0)
T6(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%RD=0)
T7(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%RD=0)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# ZyNOS F/W Version: V3.40(AHF.0)b12 | 7/30/2007, DSL FW Version:TI AR7 06.02.00.7b
# ZyNOS version: V3.40(AHF.0)b23 | 04/07/2011
Fingerprint ZyXEL ZyNOS 3.40
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3.40 auto
SEQ(SP=0-5%GCD=64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=F8-103%TG=FF%W=400%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=F8-103%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=N%T=F8-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=F8-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F8-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=N)
U1(DF=N%T=F8-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F8-103%TG=FF%CD=S)

# ZyNOS Firmware Version:  V3.40(AON.4) | 03/19/2009
Fingerprint ZyXEL ZyNOS 3.40
Class ZyXEL | ZyNOS | 3.X | broadband router
CPE cpe:/o:zyxel:zynos:3.40 auto
SEQ(SP=0-5%GCD=64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M550%O2=M550%O3=M550%O4=M550%O5=M550%O6=M550)
WIN(W1=5500%W2=5500%W3=5500%W4=5500%W5=5500%W6=5500)
ECN(R=Y%DF=N%T=F9-103%TG=FF%W=5500%O=M550%CC=N%Q=)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# Model Name : ZyWALL 10W, ZyNOS Firmware Version: V3.62(WH.1) | 02/26/2004
Fingerprint ZyXEL ZyWALL 10W firewall (ZyNOS 3.62)
Class ZyXEL | ZyNOS | 3.X | firewall
CPE cpe:/o:zyxel:zynos:3.62 auto
SEQ(SP=0-2B%GCD=1000|2000|3000|4000|5000|68000|D0000|138000|1A0000|208000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M578%O2=M578%O3=M578%O4=M578%O5=M578%O6=M578)
WIN(W1=5780%W2=5780%W3=5780%W4=5780%W5=5780%W6=5780)
ECN(R=Y%DF=N%T=FE%TG=FF%W=5780%O=M578%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyNOS Firmware Version: V3.62(WK.16) ZyWALL 2
# ZerXEL Prestige 660HW-61
Fingerprint ZyXEL ZyWALL 2 firewall or Prestige 660HW-61 ADSL router (ZyNOS 3.62)
Class ZyXEL | ZyNOS | 3.X | firewall
CPE cpe:/o:zyxel:zynos:3.62 auto
SEQ(SP=0-29%GCD=1000|2000|3000|4000|5000|6000|64000|C8000|12C000|190000|1F4000|258000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
WIN(W1=0|400%W2=0|400%W3=0|400%W4=0|400%W5=0|400%W6=0|400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0|400%O=|M200%CC=N|Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyXEL ZyWALL 70 Internet Security Appliance, firmware 3.65(WM.8)C0
Fingerprint ZyXEL ZyWALL 70 firewall (ZyNOS 3.65)
Class ZyXEL | ZyNOS | 3.X | firewall
CPE cpe:/o:zyxel:zynos:3.65 auto
SEQ(R=N)
OPS(O1=M200%O2=%O3=%O4=%O5=%O6=)
WIN(W1=2000%W2=0%W3=0%W4=0%W5=0%W6=0)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0%O=%CC=Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyXEL G-3000H WLAN access point, ZyNOS Firmware Version: V3.50(AAC.5)C0 | 03/28/2007
Fingerprint ZyXEL G-3000H WAP (ZyNOS 3.50)
Class ZyXEL | ZyNOS | 3.X | WAP
CPE cpe:/o:zyxel:zynos:3.50 auto
SEQ(SP=0-5%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=400%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyWALL 2 Plus, Bootbase Version V1.12, Firmware Version V4.04(XU.2)
# Zyxel Zywall 70 UTM
# zyxel zywall 5
Fingerprint ZyXEL ZyWALL 2, 5, or 70 firewall (ZyNOS 4.04)
Class ZyXEL | ZyNOS | 4.X | firewall
CPE cpe:/o:zyxel:zynos:4.04 auto
SEQ(SP=0-B%GCD=A000|14000|1E000|28000|32000|64000|C8000|12C000|190000|1F4000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FE%TG=FF%W=2000%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyWALL 5 Bootbase Version        V1.08 | 01/17/2005, Firmware Version        V4.04(XD.8) | 02/11/2010
Fingerprint ZyXEL ZyWALL 5 firewall (ZyNOS 4.04)
Class ZyXEL | ZyNOS | 4.X | firewall
CPE cpe:/o:zyxel:zynos:4.04 auto
SEQ(SP=0-5%GCD=6E000|DC000|14A000|1B8000|226000%ISR=AB-B5%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=FA-104%TG=FF%W=2000%O=|M200%CC=N%Q=)
T1(R=Y%DF=N%T=FA-104%TG=FF%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FA-104%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FA-104%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FA-104%TG=FF%CD=S)

# ZyWALL 5, Bootbase Version V1.08, Firmware Version V4.04(XD.0)
# ZyXEL ZyWALL 2 Plus, from around 2010, v4.04
Fingerprint ZyXEL ZyWALL firewall (ZyNOS 4.04)
Class ZyXEL | ZyNOS | 4.X | firewall
CPE cpe:/o:zyxel:zynos:4.04 auto
SEQ(SP=0-12%GCD=A000|14000|1E000|28000|32000|6E000|DC000|14A000|1B8000|226000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000)
ECN(R=Y%DF=N%T=F9-103%TG=FF%W=0|2000%O=|M200%CC=N|Y%Q=)
T1(R=Y%DF=N%T=F9-103%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=F9-103%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=F9-103%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=F9-103%TG=FF%CD=S)

# Zyxel Prestige 2602R-D1A
Fingerprint ZyXEL Prestige 2602R-D1A ADSL router
Class ZyXEL | ZyNOS || broadband router
CPE cpe:/o:zyxel:zynos auto
SEQ(SP=D-17%GCD=A000|14000|1E000|28000|32000%ISR=AB-B5%TI=I%CI=I%II=I%SS=S%TS=U)
OPS(O1=M550%O2=M550%O3=M550%O4=M550%O5=M550%O6=M550)
WIN(W1=800%W2=800%W3=800%W4=800%W5=800%W6=800)
ECN(R=Y%DF=N%T=FE%TG=FF%W=800%O=M550%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyXEL Prestige 600 series router.
Fingerprint ZyXEL Prestige 600-series ADSL router
Class ZyXEL | ZyNOS || broadband router
CPE cpe:/o:zyxel:zynos auto
SEQ(SP=0-5%GCD=68000|D0000|138000|1A0000|208000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
WIN(W1=0|400%W2=0|400%W3=0|400%W4=0|400%W5=0|400%W6=0|400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0|400%O=|M200%CC=N|Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%T=FE%TG=FF%W=400%S=O%A=O|S+%F=AS%O=M200%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# ZyXEL Prestige 660HW-61 ADSL router; ZyNOS F/W Version: V3.40(PE.10) | 10/28/2005
Fingerprint ZyXEL Prestige 660HW-61 ADSL router (ZyNOS 3.40)
Class ZyXEL | ZyNOS || broadband router
CPE cpe:/o:zyxel:zynos auto
SEQ(SP=4-14%GCD=A000|14000|1E000|28000|32000|3C000%ISR=AF-B1%TI=I%II=I%SS=S%TS=U)
OPS(O1=M200%O2=M200%O3=M200%O4=M200%O5=M200%O6=M200)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=400%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# zyxel P-660HW-D1, ADSL+LAN+WLAN router with default configurations.
Fingerprint ZyXEL Prestige 660HW-D1 wireless ADSL router
Class ZyXEL | ZyNOS || broadband router
CPE cpe:/o:zyxel:zynos auto
SEQ(SP=0-5%GCD=6E000|DC000|14A000|1B8000|226000%ISR=AB-B5%TI=I|RD%II=I%SS=S%TS=U)
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
WIN(W1=400%W2=400%W3=400%W4=400%W5=400%W6=400)
ECN(R=Y%DF=N%T=FE%TG=FF%W=400%O=M200%CC=N%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O%A=O|S+%F=A|AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=N)
T7(R=N)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)

# zyxel zywall 2 plus
Fingerprint ZyXEL ZyWALL 2 Plus firewall
Class ZyXEL | ZyNOS || firewall
CPE cpe:/o:zyxel:zynos auto
SEQ(SP=B-15%GCD=A000|14000|1E000|28000|32000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
OPS(O1=|M584%O2=|M584%O3=|M584%O4=|M584%O5=|M584%O6=|M584)
WIN(W1=0|5B40%W2=0|5B40%W3=0|5B40%W4=0|5B40%W5=0|5B40%W6=0|5B40)
ECN(R=Y%DF=N%T=FE%TG=FF%W=0|5B40%O=|M584%CC=N|Y%Q=)
T1(R=Y%DF=N%T=FE%TG=FF%S=O|Z%A=S+%F=AR|AS%RD=0%Q=)
T2(R=N)
T3(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T4(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=N%T=FE%TG=FF%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%T=FE%TG=FF%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
U1(DF=N%T=FE%TG=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=D624%RUD=G)
IE(DFI=N%T=FE%TG=FF%CD=S)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 /*
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
 * Copyright 2005 Nokia. All rights reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#ifndef OPENSSL_TLS1_H
# define OPENSSL_TLS1_H
# pragma once

# include <openssl/macros.h>
# ifndef OPENSSL_NO_DEPRECATED_3_0
#  define HEADER_TLS1_H
# endif

# include <openssl/buffer.h>
# include <openssl/x509.h>
# include <openssl/prov_ssl.h>

#ifdef  __cplusplus
extern "C" {
#endif

/* Default security level if not overridden at config time */
# ifndef OPENSSL_TLS_SECURITY_LEVEL
#  define OPENSSL_TLS_SECURITY_LEVEL 1
# endif

/* TLS*_VERSION constants are defined in prov_ssl.h */
# ifndef OPENSSL_NO_DEPRECATED_3_0
#  define TLS_MAX_VERSION                TLS1_3_VERSION
# endif

/* Special value for method supporting multiple versions */
# define TLS_ANY_VERSION                 0x10000

# define TLS1_VERSION_MAJOR              0x03
# define TLS1_VERSION_MINOR              0x01

# define TLS1_1_VERSION_MAJOR            0x03
# define TLS1_1_VERSION_MINOR            0x02

# define TLS1_2_VERSION_MAJOR            0x03
# define TLS1_2_VERSION_MINOR            0x03

# define TLS1_get_version(s) \
        ((SSL_version(s) >> 8) == TLS1_VERSION_MAJOR ? SSL_version(s) : 0)

# define TLS1_get_client_version(s) \
        ((SSL_client_version(s) >> 8) == TLS1_VERSION_MAJOR ? SSL_client_version(s) : 0)

# define TLS1_AD_DECRYPTION_FAILED       21
# define TLS1_AD_RECORD_OVERFLOW         22
# define TLS1_AD_UNKNOWN_CA              48/* fatal */
# define TLS1_AD_ACCESS_DENIED           49/* fatal */
# define TLS1_AD_DECODE_ERROR            50/* fatal */
# define TLS1_AD_DECRYPT_ERROR           51
# define TLS1_AD_EXPORT_RESTRICTION      60/* fatal */
# define TLS1_AD_PROTOCOL_VERSION        70/* fatal */
# define TLS1_AD_INSUFFICIENT_SECURITY   71/* fatal */
# define TLS1_AD_INTERNAL_ERROR          80/* fatal */
# define TLS1_AD_INAPPROPRIATE_FALLBACK  86/* fatal */
# define TLS1_AD_USER_CANCELLED          90
# define TLS1_AD_NO_RENEGOTIATION        100
/* TLSv1.3 alerts */
# define TLS13_AD_MISSING_EXTENSION      109 /* fatal */
# define TLS13_AD_CERTIFICATE_REQUIRED   116 /* fatal */
/* codes 110-114 are from RFC3546 */
# define TLS1_AD_UNSUPPORTED_EXTENSION   110
# define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111
# define TLS1_AD_UNRECOGNIZED_NAME       112
# define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113
# define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114
# define TLS1_AD_UNKNOWN_PSK_IDENTITY    115/* fatal */
# define TLS1_AD_NO_APPLICATION_PROTOCOL 120 /* fatal */

/* ExtensionType values from RFC3546 / RFC4366 / RFC6066 */
# define TLSEXT_TYPE_server_name                 0
# define TLSEXT_TYPE_max_fragment_length         1
# define TLSEXT_TYPE_client_certificate_url      2
# define TLSEXT_TYPE_trusted_ca_keys             3
# define TLSEXT_TYPE_truncated_hmac              4
# define TLSEXT_TYPE_status_request              5
/* ExtensionType values from RFC4681 */
# define TLSEXT_TYPE_user_mapping                6
/* ExtensionType values from RFC5878 */
# define TLSEXT_TYPE_client_authz                7
# define TLSEXT_TYPE_server_authz                8
/* ExtensionType values from RFC6091 */
# define TLSEXT_TYPE_cert_type           9

/* ExtensionType values from RFC4492 */
/*
 * Prior to TLSv1.3 the supported_groups extension was known as
 * elliptic_curves
 */
# define TLSEXT_TYPE_supported_groups            10
# define TLSEXT_TYPE_elliptic_curves             TLSEXT_TYPE_supported_groups
# define TLSEXT_TYPE_ec_point_formats            11


/* ExtensionType value from RFC5054 */
# define TLSEXT_TYPE_srp                         12

/* ExtensionType values from RFC5246 */
# define TLSEXT_TYPE_signature_algorithms        13

/* ExtensionType value from RFC5764 */
# define TLSEXT_TYPE_use_srtp    14

/* ExtensionType value from RFC7301 */
# define TLSEXT_TYPE_application_layer_protocol_negotiation 16

/*
 * Extension type for Certificate Transparency
 * https://tools.ietf.org/html/rfc6962#section-3.3.1
 */
# define TLSEXT_TYPE_signed_certificate_timestamp    18

/*
 * ExtensionType value for TLS padding extension.
 * http://tools.ietf.org/html/draft-agl-tls-padding
 */
# define TLSEXT_TYPE_padding     21

/* ExtensionType value from RFC7366 */
# define TLSEXT_TYPE_encrypt_then_mac    22

/* ExtensionType value from RFC7627 */
# define TLSEXT_TYPE_extended_master_secret      23

/* ExtensionType value from RFC4507 */
# define TLSEXT_TYPE_session_ticket              35

/* As defined for TLS1.3 */
# define TLSEXT_TYPE_psk                         41
# define TLSEXT_TYPE_early_data                  42
# define TLSEXT_TYPE_supported_versions          43
# define TLSEXT_TYPE_cookie                      44
# define TLSEXT_TYPE_psk_kex_modes               45
# define TLSEXT_TYPE_certificate_authorities     47
# define TLSEXT_TYPE_post_handshake_auth         49
# define TLSEXT_TYPE_signature_algorithms_cert   50
# define TLSEXT_TYPE_key_share                   51

/* Temporary extension type */
# define TLSEXT_TYPE_renegotiate                 0xff01

    /* ExtensionType value from RFC9001 */
# define TLSEXT_TYPE_quic_transport_parameters_draft   0xffa5
# define TLSEXT_TYPE_quic_transport_parameters         0x0039

# ifndef OPENSSL_NO_NEXTPROTONEG
/* This is not an IANA defined extension number */
#  define TLSEXT_TYPE_next_proto_neg              13172
# endif

/* NameType value from RFC3546 */
# define TLSEXT_NAMETYPE_host_name 0
/* status request value from RFC3546 */
# define TLSEXT_STATUSTYPE_ocsp 1

/* ECPointFormat values from RFC4492 */
# define TLSEXT_ECPOINTFORMAT_first                      0
# define TLSEXT_ECPOINTFORMAT_uncompressed               0
# define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime  1
# define TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2  2
# define TLSEXT_ECPOINTFORMAT_last                       2

/* Signature and hash algorithms from RFC5246 */
# define TLSEXT_signature_anonymous                      0
# define TLSEXT_signature_rsa                            1
# define TLSEXT_signature_dsa                            2
# define TLSEXT_signature_ecdsa                          3
# define TLSEXT_signature_gostr34102001                  237
# define TLSEXT_signature_gostr34102012_256              238
# define TLSEXT_signature_gostr34102012_512              239

/* Total number of different signature algorithms */
# define TLSEXT_signature_num                            7

# define TLSEXT_hash_none                                0
# define TLSEXT_hash_md5                                 1
# define TLSEXT_hash_sha1                                2
# define TLSEXT_hash_sha224                              3
# define TLSEXT_hash_sha256                              4
# define TLSEXT_hash_sha384                              5
# define TLSEXT_hash_sha512                              6
# define TLSEXT_hash_gostr3411                           237
# define TLSEXT_hash_gostr34112012_256                   238
# define TLSEXT_hash_gostr34112012_512                   239

/* Total number of different digest algorithms */

# define TLSEXT_hash_num                                 10

/* Flag set for unrecognised algorithms */
# define TLSEXT_nid_unknown                              0x1000000

/* ECC curves */

# define TLSEXT_curve_P_256                              23
# define TLSEXT_curve_P_384                              24

/* OpenSSL value to disable maximum fragment length extension */
# define TLSEXT_max_fragment_length_DISABLED    0
/* Allowed values for max fragment length extension */
# define TLSEXT_max_fragment_length_512         1
# define TLSEXT_max_fragment_length_1024        2
# define TLSEXT_max_fragment_length_2048        3
# define TLSEXT_max_fragment_length_4096        4
/* OpenSSL value for unset maximum fragment length extension */
# define TLSEXT_max_fragment_length_UNSPECIFIED 255

int SSL_CTX_set_tlsext_max_fragment_length(SSL_CTX *ctx, uint8_t mode);
int SSL_set_tlsext_max_fragment_length(SSL *ssl, uint8_t mode);

# define TLSEXT_MAXLEN_host_name 255

__owur const char *SSL_get_servername(const SSL *s, const int type);
__owur int SSL_get_servername_type(const SSL *s);
/*
 * SSL_export_keying_material exports a value derived from the master secret,
 * as specified in RFC 5705. It writes |olen| bytes to |out| given a label and
 * optional context. (Since a zero length context is allowed, the |use_context|
 * flag controls whether a context is included.) It returns 1 on success and
 * 0 or -1 otherwise.
 */
__owur int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                                      const char *label, size_t llen,
                                      const unsigned char *context,
                                      size_t contextlen, int use_context);

/*
 * SSL_export_keying_material_early exports a value derived from the
 * early exporter master secret, as specified in
 * https://tools.ietf.org/html/draft-ietf-tls-tls13-23. It writes
 * |olen| bytes to |out| given a label and optional context. It
 * returns 1 on success and 0 otherwise.
 */
__owur int SSL_export_keying_material_early(SSL *s, unsigned char *out,
                                            size_t olen, const char *label,
                                            size_t llen,
                                            const unsigned char *context,
                                            size_t contextlen);

int SSL_get_peer_signature_type_nid(const SSL *s, int *pnid);
int SSL_get_signature_type_nid(const SSL *s, int *pnid);

int SSL_get_sigalgs(SSL *s, int idx,
                    int *psign, int *phash, int *psignandhash,
                    unsigned char *rsig, unsigned char *rhash);

int SSL_get_shared_sigalgs(SSL *s, int idx,
                           int *psign, int *phash, int *psignandhash,
                           unsigned char *rsig, unsigned char *rhash);

__owur int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain);

# define SSL_set_tlsext_host_name(s,name) \
        SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,\
                (void *)name)

# define SSL_set_tlsext_debug_callback(ssl, cb) \
        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_CB,\
                (void (*)(void))cb)

# define SSL_set_tlsext_debug_arg(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_ARG,0,arg)

# define SSL_get_tlsext_status_type(ssl) \
        SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE,0,NULL)

# define SSL_set_tlsext_status_type(ssl, type) \
        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type,NULL)

# define SSL_get_tlsext_status_exts(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS,0,arg)

# define SSL_set_tlsext_status_exts(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS,0,arg)

# define SSL_get_tlsext_status_ids(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS,0,arg)

# define SSL_set_tlsext_status_ids(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0,arg)

# define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \
        SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0,arg)

# define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen,arg)

# define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \
        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,\
                (void (*)(void))cb)

# define SSL_TLSEXT_ERR_OK 0
# define SSL_TLSEXT_ERR_ALERT_WARNING 1
# define SSL_TLSEXT_ERR_ALERT_FATAL 2
# define SSL_TLSEXT_ERR_NOACK 3

# define SSL_CTX_set_tlsext_servername_arg(ctx, arg) \
        SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG,0,arg)

# define SSL_CTX_get_tlsext_ticket_keys(ctx, keys, keylen) \
        SSL_CTX_ctrl(ctx,SSL_CTRL_GET_TLSEXT_TICKET_KEYS,keylen,keys)
# define SSL_CTX_set_tlsext_ticket_keys(ctx, keys, keylen) \
        SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_TICKET_KEYS,keylen,keys)

# define SSL_CTX_get_tlsext_status_cb(ssl, cb) \
        SSL_CTX_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB,0,(void *)cb)
# define SSL_CTX_set_tlsext_status_cb(ssl, cb) \
        SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB,\
                (void (*)(void))cb)

# define SSL_CTX_get_tlsext_status_arg(ssl, arg) \
        SSL_CTX_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG,0,arg)
# define SSL_CTX_set_tlsext_status_arg(ssl, arg) \
        SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG,0,arg)

# define SSL_CTX_set_tlsext_status_type(ssl, type) \
        SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type,NULL)

# define SSL_CTX_get_tlsext_status_type(ssl) \
        SSL_CTX_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE,0,NULL)

# ifndef OPENSSL_NO_DEPRECATED_3_0
#  define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \
        SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,\
                (void (*)(void))cb)
# endif
int SSL_CTX_set_tlsext_ticket_key_evp_cb
    (SSL_CTX *ctx, int (*fp)(SSL *, unsigned char *, unsigned char *,
                             EVP_CIPHER_CTX *, EVP_MAC_CTX *, int));

/* PSK ciphersuites from 4279 */
# define TLS1_CK_PSK_WITH_RC4_128_SHA                    0x0300008A
# define TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA               0x0300008B
# define TLS1_CK_PSK_WITH_AES_128_CBC_SHA                0x0300008C
# define TLS1_CK_PSK_WITH_AES_256_CBC_SHA                0x0300008D
# define TLS1_CK_DHE_PSK_WITH_RC4_128_SHA                0x0300008E
# define TLS1_CK_DHE_PSK_WITH_3DES_EDE_CBC_SHA           0x0300008F
# define TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA            0x03000090
# define TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA            0x03000091
# define TLS1_CK_RSA_PSK_WITH_RC4_128_SHA                0x03000092
# define TLS1_CK_RSA_PSK_WITH_3DES_EDE_CBC_SHA           0x03000093
# define TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA            0x03000094
# define TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA            0x03000095

/* PSK ciphersuites from 5487 */
# define TLS1_CK_PSK_WITH_AES_128_GCM_SHA256             0x030000A8
# define TLS1_CK_PSK_WITH_AES_256_GCM_SHA384             0x030000A9
# define TLS1_CK_DHE_PSK_WITH_AES_128_GCM_SHA256         0x030000AA
# define TLS1_CK_DHE_PSK_WITH_AES_256_GCM_SHA384         0x030000AB
# define TLS1_CK_RSA_PSK_WITH_AES_128_GCM_SHA256         0x030000AC
# define TLS1_CK_RSA_PSK_WITH_AES_256_GCM_SHA384         0x030000AD
# define TLS1_CK_PSK_WITH_AES_128_CBC_SHA256             0x030000AE
# define TLS1_CK_PSK_WITH_AES_256_CBC_SHA384             0x030000AF
# define TLS1_CK_PSK_WITH_NULL_SHA256                    0x030000B0
# define TLS1_CK_PSK_WITH_NULL_SHA384                    0x030000B1
# define TLS1_CK_DHE_PSK_WITH_AES_128_CBC_SHA256         0x030000B2
# define TLS1_CK_DHE_PSK_WITH_AES_256_CBC_SHA384         0x030000B3
# define TLS1_CK_DHE_PSK_WITH_NULL_SHA256                0x030000B4
# define TLS1_CK_DHE_PSK_WITH_NULL_SHA384                0x030000B5
# define TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA256         0x030000B6
# define TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA384         0x030000B7
# define TLS1_CK_RSA_PSK_WITH_NULL_SHA256                0x030000B8
# define TLS1_CK_RSA_PSK_WITH_NULL_SHA384                0x030000B9

/* NULL PSK ciphersuites from RFC4785 */
# define TLS1_CK_PSK_WITH_NULL_SHA                       0x0300002C
# define TLS1_CK_DHE_PSK_WITH_NULL_SHA                   0x0300002D
# define TLS1_CK_RSA_PSK_WITH_NULL_SHA                   0x0300002E

/* AES ciphersuites from RFC3268 */
# define TLS1_CK_RSA_WITH_AES_128_SHA                    0x0300002F
# define TLS1_CK_DH_DSS_WITH_AES_128_SHA                 0x03000030
# define TLS1_CK_DH_RSA_WITH_AES_128_SHA                 0x03000031
# define TLS1_CK_DHE_DSS_WITH_AES_128_SHA                0x03000032
# define TLS1_CK_DHE_RSA_WITH_AES_128_SHA                0x03000033
# define TLS1_CK_ADH_WITH_AES_128_SHA                    0x03000034
# define TLS1_CK_RSA_WITH_AES_256_SHA                    0x03000035
# define TLS1_CK_DH_DSS_WITH_AES_256_SHA                 0x03000036
# define TLS1_CK_DH_RSA_WITH_AES_256_SHA                 0x03000037
# define TLS1_CK_DHE_DSS_WITH_AES_256_SHA                0x03000038
# define TLS1_CK_DHE_RSA_WITH_AES_256_SHA                0x03000039
# define TLS1_CK_ADH_WITH_AES_256_SHA                    0x0300003A

/* TLS v1.2 ciphersuites */
# define TLS1_CK_RSA_WITH_NULL_SHA256                    0x0300003B
# define TLS1_CK_RSA_WITH_AES_128_SHA256                 0x0300003C
# define TLS1_CK_RSA_WITH_AES_256_SHA256                 0x0300003D
# define TLS1_CK_DH_DSS_WITH_AES_128_SHA256              0x0300003E
# define TLS1_CK_DH_RSA_WITH_AES_128_SHA256              0x0300003F
# define TLS1_CK_DHE_DSS_WITH_AES_128_SHA256             0x03000040

/* Camellia ciphersuites from RFC4132 */
# define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA           0x03000041
# define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA        0x03000042
# define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA        0x03000043
# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA       0x03000044
# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA       0x03000045
# define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA           0x03000046

/* TLS v1.2 ciphersuites */
# define TLS1_CK_DHE_RSA_WITH_AES_128_SHA256             0x03000067
# define TLS1_CK_DH_DSS_WITH_AES_256_SHA256              0x03000068
# define TLS1_CK_DH_RSA_WITH_AES_256_SHA256              0x03000069
# define TLS1_CK_DHE_DSS_WITH_AES_256_SHA256             0x0300006A
# define TLS1_CK_DHE_RSA_WITH_AES_256_SHA256             0x0300006B
# define TLS1_CK_ADH_WITH_AES_128_SHA256                 0x0300006C
# define TLS1_CK_ADH_WITH_AES_256_SHA256                 0x0300006D

/* Camellia ciphersuites from RFC4132 */
# define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA           0x03000084
# define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA        0x03000085
# define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA        0x03000086
# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA       0x03000087
# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA       0x03000088
# define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA           0x03000089

/* SEED ciphersuites from RFC4162 */
# define TLS1_CK_RSA_WITH_SEED_SHA                       0x03000096
# define TLS1_CK_DH_DSS_WITH_SEED_SHA                    0x03000097
# define TLS1_CK_DH_RSA_WITH_SEED_SHA                    0x03000098
# define TLS1_CK_DHE_DSS_WITH_SEED_SHA                   0x03000099
# define TLS1_CK_DHE_RSA_WITH_SEED_SHA                   0x0300009A
# define TLS1_CK_ADH_WITH_SEED_SHA                       0x0300009B

/* TLS v1.2 GCM ciphersuites from RFC5288 */
# define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256             0x0300009C
# define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384             0x0300009D
# define TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256         0x0300009E
# define TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384         0x0300009F
# define TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256          0x030000A0
# define TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384          0x030000A1
# define TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256         0x030000A2
# define TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384         0x030000A3
# define TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256          0x030000A4
# define TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384          0x030000A5
# define TLS1_CK_ADH_WITH_AES_128_GCM_SHA256             0x030000A6
# define TLS1_CK_ADH_WITH_AES_256_GCM_SHA384             0x030000A7

/* CCM ciphersuites from RFC6655 */
# define TLS1_CK_RSA_WITH_AES_128_CCM                    0x0300C09C
# define TLS1_CK_RSA_WITH_AES_256_CCM                    0x0300C09D
# define TLS1_CK_DHE_RSA_WITH_AES_128_CCM                0x0300C09E
# define TLS1_CK_DHE_RSA_WITH_AES_256_CCM                0x0300C09F
# define TLS1_CK_RSA_WITH_AES_128_CCM_8                  0x0300C0A0
# define TLS1_CK_RSA_WITH_AES_256_CCM_8                  0x0300C0A1
# define TLS1_CK_DHE_RSA_WITH_AES_128_CCM_8              0x0300C0A2
# define TLS1_CK_DHE_RSA_WITH_AES_256_CCM_8              0x0300C0A3
# define TLS1_CK_PSK_WITH_AES_128_CCM                    0x0300C0A4
# define TLS1_CK_PSK_WITH_AES_256_CCM                    0x0300C0A5
# define TLS1_CK_DHE_PSK_WITH_AES_128_CCM                0x0300C0A6
# define TLS1_CK_DHE_PSK_WITH_AES_256_CCM                0x0300C0A7
# define TLS1_CK_PSK_WITH_AES_128_CCM_8                  0x0300C0A8
# define TLS1_CK_PSK_WITH_AES_256_CCM_8                  0x0300C0A9
# define TLS1_CK_DHE_PSK_WITH_AES_128_CCM_8              0x0300C0AA
# define TLS1_CK_DHE_PSK_WITH_AES_256_CCM_8              0x0300C0AB

/* CCM ciphersuites from RFC7251 */
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM            0x0300C0AC
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM            0x0300C0AD
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CCM_8          0x0300C0AE
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CCM_8          0x0300C0AF

/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
# define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA256                0x030000BA
# define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256             0x030000BB
# define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256             0x030000BC
# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256            0x030000BD
# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256            0x030000BE
# define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA256                0x030000BF

# define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA256                0x030000C0
# define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256             0x030000C1
# define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256             0x030000C2
# define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256            0x030000C3
# define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256            0x030000C4
# define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA256                0x030000C5

/* ECC ciphersuites from RFC4492 */
# define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA                0x0300C001
# define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA             0x0300C002
# define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA        0x0300C003
# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA         0x0300C004
# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA         0x0300C005

# define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA               0x0300C006
# define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA            0x0300C007
# define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA       0x0300C008
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA        0x0300C009
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA        0x0300C00A

# define TLS1_CK_ECDH_RSA_WITH_NULL_SHA                  0x0300C00B
# define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA               0x0300C00C
# define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA          0x0300C00D
# define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA           0x0300C00E
# define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA           0x0300C00F

# define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA                 0x0300C010
# define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA              0x0300C011
# define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA         0x0300C012
# define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA          0x0300C013
# define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA          0x0300C014

# define TLS1_CK_ECDH_anon_WITH_NULL_SHA                 0x0300C015
# define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA              0x0300C016
# define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA         0x0300C017
# define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA          0x0300C018
# define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA          0x0300C019

/* SRP ciphersuites from RFC 5054 */
# define TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA           0x0300C01A
# define TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA       0x0300C01B
# define TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA       0x0300C01C
# define TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA            0x0300C01D
# define TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA        0x0300C01E
# define TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA        0x0300C01F
# define TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA            0x0300C020
# define TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA        0x0300C021
# define TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA        0x0300C022

/* ECDH HMAC based ciphersuites from RFC5289 */
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256         0x0300C023
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384         0x0300C024
# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256          0x0300C025
# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384          0x0300C026
# define TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256           0x0300C027
# define TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384           0x0300C028
# define TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256            0x0300C029
# define TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384            0x0300C02A

/* ECDH GCM based ciphersuites from RFC5289 */
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256     0x0300C02B
# define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384     0x0300C02C
# define TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256      0x0300C02D
# define TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384      0x0300C02E
# define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256       0x0300C02F
# define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384       0x0300C030
# define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256        0x0300C031
# define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384        0x0300C032

/* ECDHE PSK ciphersuites from RFC5489 */
# define TLS1_CK_ECDHE_PSK_WITH_RC4_128_SHA              0x0300C033
# define TLS1_CK_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA         0x0300C034
# define TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA          0x0300C035
# define TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA          0x0300C036

# define TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA256       0x0300C037
# define TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA384       0x0300C038

/* NULL PSK ciphersuites from RFC4785 */
# define TLS1_CK_ECDHE_PSK_WITH_NULL_SHA                 0x0300C039
# define TLS1_CK_ECDHE_PSK_WITH_NULL_SHA256              0x0300C03A
# define TLS1_CK_ECDHE_PSK_WITH_NULL_SHA384              0x0300C03B

/* Camellia-CBC ciphersuites from RFC6367 */
# define TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0x0300C072
# define TLS1_CK_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0x0300C073
# define TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  0x0300C074
# define TLS1_CK_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  0x0300C075
# define TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   0x0300C076
# define TLS1_CK_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   0x0300C077
# define TLS1_CK_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256    0x0300C078
# define TLS1_CK_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384    0x0300C079

# define TLS1_CK_PSK_WITH_CAMELLIA_128_CBC_SHA256         0x0300C094
# define TLS1_CK_PSK_WITH_CAMELLIA_256_CBC_SHA384         0x0300C095
# define TLS1_CK_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256     0x0300C096
# define TLS1_CK_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384     0x0300C097
# define TLS1_CK_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256     0x0300C098
# define TLS1_CK_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384     0x0300C099
# define TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256   0x0300C09A
# define TLS1_CK_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384   0x0300C09B

/* draft-ietf-tls-chacha20-poly1305-03 */
# define TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305         0x0300CCA8
# define TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305       0x0300CCA9
# define TLS1_CK_DHE_RSA_WITH_CHACHA20_POLY1305           0x0300CCAA
# define TLS1_CK_PSK_WITH_CHACHA20_POLY1305               0x0300CCAB
# define TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305         0x0300CCAC
# define TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305           0x0300CCAD
# define TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305           0x0300CCAE

/* TLS v1.3 ciphersuites */
# define TLS1_3_CK_AES_128_GCM_SHA256                     0x03001301
# define TLS1_3_CK_AES_256_GCM_SHA384                     0x03001302
# define TLS1_3_CK_CHACHA20_POLY1305_SHA256               0x03001303
# define TLS1_3_CK_AES_128_CCM_SHA256                     0x03001304
# define TLS1_3_CK_AES_128_CCM_8_SHA256                   0x03001305

/* Aria ciphersuites from RFC6209 */
# define TLS1_CK_RSA_WITH_ARIA_128_GCM_SHA256             0x0300C050
# define TLS1_CK_RSA_WITH_ARIA_256_GCM_SHA384             0x0300C051
# define TLS1_CK_DHE_RSA_WITH_ARIA_128_GCM_SHA256         0x0300C052
# define TLS1_CK_DHE_RSA_WITH_ARIA_256_GCM_SHA384         0x0300C053
# define TLS1_CK_DH_RSA_WITH_ARIA_128_GCM_SHA256          0x0300C054
# define TLS1_CK_DH_RSA_WITH_ARIA_256_GCM_SHA384          0x0300C055
# define TLS1_CK_DHE_DSS_WITH_ARIA_128_GCM_SHA256         0x0300C056
# define TLS1_CK_DHE_DSS_WITH_ARIA_256_GCM_SHA384         0x0300C057
# define TLS1_CK_DH_DSS_WITH_ARIA_128_GCM_SHA256          0x0300C058
# define TLS1_CK_DH_DSS_WITH_ARIA_256_GCM_SHA384          0x0300C059
# define TLS1_CK_DH_anon_WITH_ARIA_128_GCM_SHA256         0x0300C05A
# define TLS1_CK_DH_anon_WITH_ARIA_256_GCM_SHA384         0x0300C05B
# define TLS1_CK_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256     0x0300C05C
# define TLS1_CK_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384     0x0300C05D
# define TLS1_CK_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256      0x0300C05E
# define TLS1_CK_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384      0x0300C05F
# define TLS1_CK_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256       0x0300C060
# define TLS1_CK_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384       0x0300C061
# define TLS1_CK_ECDH_RSA_WITH_ARIA_128_GCM_SHA256        0x0300C062
# define TLS1_CK_ECDH_RSA_WITH_ARIA_256_GCM_SHA384        0x0300C063
# define TLS1_CK_PSK_WITH_ARIA_128_GCM_SHA256             0x0300C06A
# define TLS1_CK_PSK_WITH_ARIA_256_GCM_SHA384             0x0300C06B
# define TLS1_CK_DHE_PSK_WITH_ARIA_128_GCM_SHA256         0x0300C06C
# define TLS1_CK_DHE_PSK_WITH_ARIA_256_GCM_SHA384         0x0300C06D
# define TLS1_CK_RSA_PSK_WITH_ARIA_128_GCM_SHA256         0x0300C06E
# define TLS1_CK_RSA_PSK_WITH_ARIA_256_GCM_SHA384         0x0300C06F

/* a bundle of RFC standard cipher names, generated from ssl3_ciphers[] */
# define TLS1_RFC_RSA_WITH_AES_128_SHA                   "TLS_RSA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_DHE_DSS_WITH_AES_128_SHA               "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_AES_128_SHA               "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_ADH_WITH_AES_128_SHA                   "TLS_DH_anon_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_RSA_WITH_AES_256_SHA                   "TLS_RSA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_DHE_DSS_WITH_AES_256_SHA               "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_AES_256_SHA               "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_ADH_WITH_AES_256_SHA                   "TLS_DH_anon_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_RSA_WITH_NULL_SHA256                   "TLS_RSA_WITH_NULL_SHA256"
# define TLS1_RFC_RSA_WITH_AES_128_SHA256                "TLS_RSA_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_RSA_WITH_AES_256_SHA256                "TLS_RSA_WITH_AES_256_CBC_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_AES_128_SHA256            "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_AES_128_SHA256            "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_AES_256_SHA256            "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_AES_256_SHA256            "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"
# define TLS1_RFC_ADH_WITH_AES_128_SHA256                "TLS_DH_anon_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_ADH_WITH_AES_256_SHA256                "TLS_DH_anon_WITH_AES_256_CBC_SHA256"
# define TLS1_RFC_RSA_WITH_AES_128_GCM_SHA256            "TLS_RSA_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_RSA_WITH_AES_256_GCM_SHA384            "TLS_RSA_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_DHE_RSA_WITH_AES_128_GCM_SHA256        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_AES_256_GCM_SHA384        "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_DHE_DSS_WITH_AES_128_GCM_SHA256        "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_AES_256_GCM_SHA384        "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_ADH_WITH_AES_128_GCM_SHA256            "TLS_DH_anon_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_ADH_WITH_AES_256_GCM_SHA384            "TLS_DH_anon_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_RSA_WITH_AES_128_CCM                   "TLS_RSA_WITH_AES_128_CCM"
# define TLS1_RFC_RSA_WITH_AES_256_CCM                   "TLS_RSA_WITH_AES_256_CCM"
# define TLS1_RFC_DHE_RSA_WITH_AES_128_CCM               "TLS_DHE_RSA_WITH_AES_128_CCM"
# define TLS1_RFC_DHE_RSA_WITH_AES_256_CCM               "TLS_DHE_RSA_WITH_AES_256_CCM"
# define TLS1_RFC_RSA_WITH_AES_128_CCM_8                 "TLS_RSA_WITH_AES_128_CCM_8"
# define TLS1_RFC_RSA_WITH_AES_256_CCM_8                 "TLS_RSA_WITH_AES_256_CCM_8"
# define TLS1_RFC_DHE_RSA_WITH_AES_128_CCM_8             "TLS_DHE_RSA_WITH_AES_128_CCM_8"
# define TLS1_RFC_DHE_RSA_WITH_AES_256_CCM_8             "TLS_DHE_RSA_WITH_AES_256_CCM_8"
# define TLS1_RFC_PSK_WITH_AES_128_CCM                   "TLS_PSK_WITH_AES_128_CCM"
# define TLS1_RFC_PSK_WITH_AES_256_CCM                   "TLS_PSK_WITH_AES_256_CCM"
# define TLS1_RFC_DHE_PSK_WITH_AES_128_CCM               "TLS_DHE_PSK_WITH_AES_128_CCM"
# define TLS1_RFC_DHE_PSK_WITH_AES_256_CCM               "TLS_DHE_PSK_WITH_AES_256_CCM"
# define TLS1_RFC_PSK_WITH_AES_128_CCM_8                 "TLS_PSK_WITH_AES_128_CCM_8"
# define TLS1_RFC_PSK_WITH_AES_256_CCM_8                 "TLS_PSK_WITH_AES_256_CCM_8"
# define TLS1_RFC_DHE_PSK_WITH_AES_128_CCM_8             "TLS_PSK_DHE_WITH_AES_128_CCM_8"
# define TLS1_RFC_DHE_PSK_WITH_AES_256_CCM_8             "TLS_PSK_DHE_WITH_AES_256_CCM_8"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM           "TLS_ECDHE_ECDSA_WITH_AES_128_CCM"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM           "TLS_ECDHE_ECDSA_WITH_AES_256_CCM"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CCM_8         "TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CCM_8         "TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"
# define TLS1_3_RFC_AES_128_GCM_SHA256                   "TLS_AES_128_GCM_SHA256"
# define TLS1_3_RFC_AES_256_GCM_SHA384                   "TLS_AES_256_GCM_SHA384"
# define TLS1_3_RFC_CHACHA20_POLY1305_SHA256             "TLS_CHACHA20_POLY1305_SHA256"
# define TLS1_3_RFC_AES_128_CCM_SHA256                   "TLS_AES_128_CCM_SHA256"
# define TLS1_3_RFC_AES_128_CCM_8_SHA256                 "TLS_AES_128_CCM_8_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_NULL_SHA              "TLS_ECDHE_ECDSA_WITH_NULL_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_CBC_SHA       "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_CBC_SHA       "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_ECDHE_RSA_WITH_NULL_SHA                "TLS_ECDHE_RSA_WITH_NULL_SHA"
# define TLS1_RFC_ECDHE_RSA_WITH_DES_192_CBC3_SHA        "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_128_CBC_SHA         "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_256_CBC_SHA         "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_ECDH_anon_WITH_NULL_SHA                "TLS_ECDH_anon_WITH_NULL_SHA"
# define TLS1_RFC_ECDH_anon_WITH_DES_192_CBC3_SHA        "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_ECDH_anon_WITH_AES_128_CBC_SHA         "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_ECDH_anon_WITH_AES_256_CBC_SHA         "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_SHA256        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_SHA384        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_128_SHA256          "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_256_SHA384          "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256    "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_128_GCM_SHA256      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_ECDHE_RSA_WITH_AES_256_GCM_SHA384      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_PSK_WITH_NULL_SHA                      "TLS_PSK_WITH_NULL_SHA"
# define TLS1_RFC_DHE_PSK_WITH_NULL_SHA                  "TLS_DHE_PSK_WITH_NULL_SHA"
# define TLS1_RFC_RSA_PSK_WITH_NULL_SHA                  "TLS_RSA_PSK_WITH_NULL_SHA"
# define TLS1_RFC_PSK_WITH_3DES_EDE_CBC_SHA              "TLS_PSK_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_PSK_WITH_AES_128_CBC_SHA               "TLS_PSK_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_PSK_WITH_AES_256_CBC_SHA               "TLS_PSK_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_DHE_PSK_WITH_3DES_EDE_CBC_SHA          "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA           "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA           "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_RSA_PSK_WITH_3DES_EDE_CBC_SHA          "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA           "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA           "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_PSK_WITH_AES_128_GCM_SHA256            "TLS_PSK_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_PSK_WITH_AES_256_GCM_SHA384            "TLS_PSK_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_DHE_PSK_WITH_AES_128_GCM_SHA256        "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_AES_256_GCM_SHA384        "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_RSA_PSK_WITH_AES_128_GCM_SHA256        "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_AES_256_GCM_SHA384        "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"
# define TLS1_RFC_PSK_WITH_AES_128_CBC_SHA256            "TLS_PSK_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_PSK_WITH_AES_256_CBC_SHA384            "TLS_PSK_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_PSK_WITH_NULL_SHA256                   "TLS_PSK_WITH_NULL_SHA256"
# define TLS1_RFC_PSK_WITH_NULL_SHA384                   "TLS_PSK_WITH_NULL_SHA384"
# define TLS1_RFC_DHE_PSK_WITH_AES_128_CBC_SHA256        "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_AES_256_CBC_SHA384        "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_DHE_PSK_WITH_NULL_SHA256               "TLS_DHE_PSK_WITH_NULL_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_NULL_SHA384               "TLS_DHE_PSK_WITH_NULL_SHA384"
# define TLS1_RFC_RSA_PSK_WITH_AES_128_CBC_SHA256        "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_AES_256_CBC_SHA384        "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_RSA_PSK_WITH_NULL_SHA256               "TLS_RSA_PSK_WITH_NULL_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_NULL_SHA384               "TLS_RSA_PSK_WITH_NULL_SHA384"
# define TLS1_RFC_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA        "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA         "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA         "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_ECDHE_PSK_WITH_AES_128_CBC_SHA256      "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_PSK_WITH_AES_256_CBC_SHA384      "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"
# define TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA                "TLS_ECDHE_PSK_WITH_NULL_SHA"
# define TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA256             "TLS_ECDHE_PSK_WITH_NULL_SHA256"
# define TLS1_RFC_ECDHE_PSK_WITH_NULL_SHA384             "TLS_ECDHE_PSK_WITH_NULL_SHA384"
# define TLS1_RFC_SRP_SHA_WITH_3DES_EDE_CBC_SHA          "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA      "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA      "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA"
# define TLS1_RFC_SRP_SHA_WITH_AES_128_CBC_SHA           "TLS_SRP_SHA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_SRP_SHA_RSA_WITH_AES_128_CBC_SHA       "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_SRP_SHA_DSS_WITH_AES_128_CBC_SHA       "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA"
# define TLS1_RFC_SRP_SHA_WITH_AES_256_CBC_SHA           "TLS_SRP_SHA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_SRP_SHA_RSA_WITH_AES_256_CBC_SHA       "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_SRP_SHA_DSS_WITH_AES_256_CBC_SHA       "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_CHACHA20_POLY1305         "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_ECDHE_RSA_WITH_CHACHA20_POLY1305       "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_CHACHA20_POLY1305     "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_PSK_WITH_CHACHA20_POLY1305             "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_ECDHE_PSK_WITH_CHACHA20_POLY1305       "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_CHACHA20_POLY1305         "TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_CHACHA20_POLY1305         "TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256"
# define TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA256       "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256   "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA256       "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA256       "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256   "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256   "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"
# define TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA256       "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256"
# define TLS1_RFC_RSA_WITH_CAMELLIA_256_CBC_SHA          "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"
# define TLS1_RFC_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA      "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA      "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"
# define TLS1_RFC_ADH_WITH_CAMELLIA_256_CBC_SHA          "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA"
# define TLS1_RFC_RSA_WITH_CAMELLIA_128_CBC_SHA          "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"
# define TLS1_RFC_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA      "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA      "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"
# define TLS1_RFC_ADH_WITH_CAMELLIA_128_CBC_SHA          "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_PSK_WITH_CAMELLIA_128_CBC_SHA256       "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_PSK_WITH_CAMELLIA_256_CBC_SHA384       "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256   "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384   "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256   "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384   "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"
# define TLS1_RFC_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"
# define TLS1_RFC_RSA_WITH_SEED_SHA                      "TLS_RSA_WITH_SEED_CBC_SHA"
# define TLS1_RFC_DHE_DSS_WITH_SEED_SHA                  "TLS_DHE_DSS_WITH_SEED_CBC_SHA"
# define TLS1_RFC_DHE_RSA_WITH_SEED_SHA                  "TLS_DHE_RSA_WITH_SEED_CBC_SHA"
# define TLS1_RFC_ADH_WITH_SEED_SHA                      "TLS_DH_anon_WITH_SEED_CBC_SHA"
# define TLS1_RFC_ECDHE_PSK_WITH_RC4_128_SHA             "TLS_ECDHE_PSK_WITH_RC4_128_SHA"
# define TLS1_RFC_ECDH_anon_WITH_RC4_128_SHA             "TLS_ECDH_anon_WITH_RC4_128_SHA"
# define TLS1_RFC_ECDHE_ECDSA_WITH_RC4_128_SHA           "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"
# define TLS1_RFC_ECDHE_RSA_WITH_RC4_128_SHA             "TLS_ECDHE_RSA_WITH_RC4_128_SHA"
# define TLS1_RFC_PSK_WITH_RC4_128_SHA                   "TLS_PSK_WITH_RC4_128_SHA"
# define TLS1_RFC_RSA_PSK_WITH_RC4_128_SHA               "TLS_RSA_PSK_WITH_RC4_128_SHA"
# define TLS1_RFC_DHE_PSK_WITH_RC4_128_SHA               "TLS_DHE_PSK_WITH_RC4_128_SHA"
# define TLS1_RFC_RSA_WITH_ARIA_128_GCM_SHA256           "TLS_RSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_RSA_WITH_ARIA_256_GCM_SHA384           "TLS_RSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DHE_RSA_WITH_ARIA_128_GCM_SHA256       "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DHE_RSA_WITH_ARIA_256_GCM_SHA384       "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DH_RSA_WITH_ARIA_128_GCM_SHA256        "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DH_RSA_WITH_ARIA_256_GCM_SHA384        "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DHE_DSS_WITH_ARIA_128_GCM_SHA256       "TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DHE_DSS_WITH_ARIA_256_GCM_SHA384       "TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DH_DSS_WITH_ARIA_128_GCM_SHA256        "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DH_DSS_WITH_ARIA_256_GCM_SHA384        "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DH_anon_WITH_ARIA_128_GCM_SHA256       "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DH_anon_WITH_ARIA_256_GCM_SHA384       "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256   "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384   "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256    "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384    "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256     "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384     "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_ECDH_RSA_WITH_ARIA_128_GCM_SHA256      "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_ECDH_RSA_WITH_ARIA_256_GCM_SHA384      "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_PSK_WITH_ARIA_128_GCM_SHA256           "TLS_PSK_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_PSK_WITH_ARIA_256_GCM_SHA384           "TLS_PSK_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_DHE_PSK_WITH_ARIA_128_GCM_SHA256       "TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_DHE_PSK_WITH_ARIA_256_GCM_SHA384       "TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"
# define TLS1_RFC_RSA_PSK_WITH_ARIA_128_GCM_SHA256       "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"
# define TLS1_RFC_RSA_PSK_WITH_ARIA_256_GCM_SHA384       "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"


/*
 * XXX Backward compatibility alert: Older versions of OpenSSL gave some DHE
 * ciphers names with "EDH" instead of "DHE".  Going forward, we should be
 * using DHE everywhere, though we may indefinitely maintain aliases for
 * users or configurations that used "EDH"
 */
# define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA               "DHE-DSS-RC4-SHA"

# define TLS1_TXT_PSK_WITH_NULL_SHA                      "PSK-NULL-SHA"
# define TLS1_TXT_DHE_PSK_WITH_NULL_SHA                  "DHE-PSK-NULL-SHA"
# define TLS1_TXT_RSA_PSK_WITH_NULL_SHA                  "RSA-PSK-NULL-SHA"

/* AES ciphersuites from RFC3268 */
# define TLS1_TXT_RSA_WITH_AES_128_SHA                   "AES128-SHA"
# define TLS1_TXT_DH_DSS_WITH_AES_128_SHA                "DH-DSS-AES128-SHA"
# define TLS1_TXT_DH_RSA_WITH_AES_128_SHA                "DH-RSA-AES128-SHA"
# define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA               "DHE-DSS-AES128-SHA"
# define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA               "DHE-RSA-AES128-SHA"
# define TLS1_TXT_ADH_WITH_AES_128_SHA                   "ADH-AES128-SHA"

# define TLS1_TXT_RSA_WITH_AES_256_SHA                   "AES256-SHA"
# define TLS1_TXT_DH_DSS_WITH_AES_256_SHA                "DH-DSS-AES256-SHA"
# define TLS1_TXT_DH_RSA_WITH_AES_256_SHA                "DH-RSA-AES256-SHA"
# define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA               "DHE-DSS-AES256-SHA"
# define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA               "DHE-RSA-AES256-SHA"
# define TLS1_TXT_ADH_WITH_AES_256_SHA                   "ADH-AES256-SHA"

/* ECC ciphersuites from RFC4492 */
# define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA               "ECDH-ECDSA-NULL-SHA"
# define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA            "ECDH-ECDSA-RC4-SHA"
# define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA       "ECDH-ECDSA-DES-CBC3-SHA"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA        "ECDH-ECDSA-AES128-SHA"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA        "ECDH-ECDSA-AES256-SHA"

# define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA              "ECDHE-ECDSA-NULL-SHA"
# define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA           "ECDHE-ECDSA-RC4-SHA"
# define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA      "ECDHE-ECDSA-DES-CBC3-SHA"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA       "ECDHE-ECDSA-AES128-SHA"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA       "ECDHE-ECDSA-AES256-SHA"

# define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA                 "ECDH-RSA-NULL-SHA"
# define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA              "ECDH-RSA-RC4-SHA"
# define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA         "ECDH-RSA-DES-CBC3-SHA"
# define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA          "ECDH-RSA-AES128-SHA"
# define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA          "ECDH-RSA-AES256-SHA"

# define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA                "ECDHE-RSA-NULL-SHA"
# define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA             "ECDHE-RSA-RC4-SHA"
# define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA        "ECDHE-RSA-DES-CBC3-SHA"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA         "ECDHE-RSA-AES128-SHA"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA         "ECDHE-RSA-AES256-SHA"

# define TLS1_TXT_ECDH_anon_WITH_NULL_SHA                "AECDH-NULL-SHA"
# define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA             "AECDH-RC4-SHA"
# define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA        "AECDH-DES-CBC3-SHA"
# define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA         "AECDH-AES128-SHA"
# define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA         "AECDH-AES256-SHA"

/* PSK ciphersuites from RFC 4279 */
# define TLS1_TXT_PSK_WITH_RC4_128_SHA                   "PSK-RC4-SHA"
# define TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA              "PSK-3DES-EDE-CBC-SHA"
# define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA               "PSK-AES128-CBC-SHA"
# define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA               "PSK-AES256-CBC-SHA"

# define TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA               "DHE-PSK-RC4-SHA"
# define TLS1_TXT_DHE_PSK_WITH_3DES_EDE_CBC_SHA          "DHE-PSK-3DES-EDE-CBC-SHA"
# define TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA           "DHE-PSK-AES128-CBC-SHA"
# define TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA           "DHE-PSK-AES256-CBC-SHA"
# define TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA               "RSA-PSK-RC4-SHA"
# define TLS1_TXT_RSA_PSK_WITH_3DES_EDE_CBC_SHA          "RSA-PSK-3DES-EDE-CBC-SHA"
# define TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA           "RSA-PSK-AES128-CBC-SHA"
# define TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA           "RSA-PSK-AES256-CBC-SHA"

/* PSK ciphersuites from RFC 5487 */
# define TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256            "PSK-AES128-GCM-SHA256"
# define TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384            "PSK-AES256-GCM-SHA384"
# define TLS1_TXT_DHE_PSK_WITH_AES_128_GCM_SHA256        "DHE-PSK-AES128-GCM-SHA256"
# define TLS1_TXT_DHE_PSK_WITH_AES_256_GCM_SHA384        "DHE-PSK-AES256-GCM-SHA384"
# define TLS1_TXT_RSA_PSK_WITH_AES_128_GCM_SHA256        "RSA-PSK-AES128-GCM-SHA256"
# define TLS1_TXT_RSA_PSK_WITH_AES_256_GCM_SHA384        "RSA-PSK-AES256-GCM-SHA384"

# define TLS1_TXT_PSK_WITH_AES_128_CBC_SHA256            "PSK-AES128-CBC-SHA256"
# define TLS1_TXT_PSK_WITH_AES_256_CBC_SHA384            "PSK-AES256-CBC-SHA384"
# define TLS1_TXT_PSK_WITH_NULL_SHA256                   "PSK-NULL-SHA256"
# define TLS1_TXT_PSK_WITH_NULL_SHA384                   "PSK-NULL-SHA384"

# define TLS1_TXT_DHE_PSK_WITH_AES_128_CBC_SHA256        "DHE-PSK-AES128-CBC-SHA256"
# define TLS1_TXT_DHE_PSK_WITH_AES_256_CBC_SHA384        "DHE-PSK-AES256-CBC-SHA384"
# define TLS1_TXT_DHE_PSK_WITH_NULL_SHA256               "DHE-PSK-NULL-SHA256"
# define TLS1_TXT_DHE_PSK_WITH_NULL_SHA384               "DHE-PSK-NULL-SHA384"

# define TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA256        "RSA-PSK-AES128-CBC-SHA256"
# define TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA384        "RSA-PSK-AES256-CBC-SHA384"
# define TLS1_TXT_RSA_PSK_WITH_NULL_SHA256               "RSA-PSK-NULL-SHA256"
# define TLS1_TXT_RSA_PSK_WITH_NULL_SHA384               "RSA-PSK-NULL-SHA384"

/* SRP ciphersuite from RFC 5054 */
# define TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA          "SRP-3DES-EDE-CBC-SHA"
# define TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA      "SRP-RSA-3DES-EDE-CBC-SHA"
# define TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA      "SRP-DSS-3DES-EDE-CBC-SHA"
# define TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA           "SRP-AES-128-CBC-SHA"
# define TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA       "SRP-RSA-AES-128-CBC-SHA"
# define TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA       "SRP-DSS-AES-128-CBC-SHA"
# define TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA           "SRP-AES-256-CBC-SHA"
# define TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA       "SRP-RSA-AES-256-CBC-SHA"
# define TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA       "SRP-DSS-AES-256-CBC-SHA"

/* Camellia ciphersuites from RFC4132 */
# define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA          "CAMELLIA128-SHA"
# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA       "DH-DSS-CAMELLIA128-SHA"
# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA       "DH-RSA-CAMELLIA128-SHA"
# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA      "DHE-DSS-CAMELLIA128-SHA"
# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA      "DHE-RSA-CAMELLIA128-SHA"
# define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA          "ADH-CAMELLIA128-SHA"

# define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA          "CAMELLIA256-SHA"
# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA       "DH-DSS-CAMELLIA256-SHA"
# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA       "DH-RSA-CAMELLIA256-SHA"
# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA      "DHE-DSS-CAMELLIA256-SHA"
# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA      "DHE-RSA-CAMELLIA256-SHA"
# define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA          "ADH-CAMELLIA256-SHA"

/* TLS 1.2 Camellia SHA-256 ciphersuites from RFC5932 */
# define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA256               "CAMELLIA128-SHA256"
# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256            "DH-DSS-CAMELLIA128-SHA256"
# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256            "DH-RSA-CAMELLIA128-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256           "DHE-DSS-CAMELLIA128-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256           "DHE-RSA-CAMELLIA128-SHA256"
# define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA256               "ADH-CAMELLIA128-SHA256"

# define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256               "CAMELLIA256-SHA256"
# define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256            "DH-DSS-CAMELLIA256-SHA256"
# define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256            "DH-RSA-CAMELLIA256-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256           "DHE-DSS-CAMELLIA256-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256           "DHE-RSA-CAMELLIA256-SHA256"
# define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA256               "ADH-CAMELLIA256-SHA256"

# define TLS1_TXT_PSK_WITH_CAMELLIA_128_CBC_SHA256               "PSK-CAMELLIA128-SHA256"
# define TLS1_TXT_PSK_WITH_CAMELLIA_256_CBC_SHA384               "PSK-CAMELLIA256-SHA384"
# define TLS1_TXT_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256           "DHE-PSK-CAMELLIA128-SHA256"
# define TLS1_TXT_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384           "DHE-PSK-CAMELLIA256-SHA384"
# define TLS1_TXT_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256           "RSA-PSK-CAMELLIA128-SHA256"
# define TLS1_TXT_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384           "RSA-PSK-CAMELLIA256-SHA384"
# define TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256         "ECDHE-PSK-CAMELLIA128-SHA256"
# define TLS1_TXT_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384         "ECDHE-PSK-CAMELLIA256-SHA384"

/* SEED ciphersuites from RFC4162 */
# define TLS1_TXT_RSA_WITH_SEED_SHA                      "SEED-SHA"
# define TLS1_TXT_DH_DSS_WITH_SEED_SHA                   "DH-DSS-SEED-SHA"
# define TLS1_TXT_DH_RSA_WITH_SEED_SHA                   "DH-RSA-SEED-SHA"
# define TLS1_TXT_DHE_DSS_WITH_SEED_SHA                  "DHE-DSS-SEED-SHA"
# define TLS1_TXT_DHE_RSA_WITH_SEED_SHA                  "DHE-RSA-SEED-SHA"
# define TLS1_TXT_ADH_WITH_SEED_SHA                      "ADH-SEED-SHA"

/* TLS v1.2 ciphersuites */
# define TLS1_TXT_RSA_WITH_NULL_SHA256                   "NULL-SHA256"
# define TLS1_TXT_RSA_WITH_AES_128_SHA256                "AES128-SHA256"
# define TLS1_TXT_RSA_WITH_AES_256_SHA256                "AES256-SHA256"
# define TLS1_TXT_DH_DSS_WITH_AES_128_SHA256             "DH-DSS-AES128-SHA256"
# define TLS1_TXT_DH_RSA_WITH_AES_128_SHA256             "DH-RSA-AES128-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256            "DHE-DSS-AES128-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256            "DHE-RSA-AES128-SHA256"
# define TLS1_TXT_DH_DSS_WITH_AES_256_SHA256             "DH-DSS-AES256-SHA256"
# define TLS1_TXT_DH_RSA_WITH_AES_256_SHA256             "DH-RSA-AES256-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256            "DHE-DSS-AES256-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256            "DHE-RSA-AES256-SHA256"
# define TLS1_TXT_ADH_WITH_AES_128_SHA256                "ADH-AES128-SHA256"
# define TLS1_TXT_ADH_WITH_AES_256_SHA256                "ADH-AES256-SHA256"

/* TLS v1.2 GCM ciphersuites from RFC5288 */
# define TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256            "AES128-GCM-SHA256"
# define TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384            "AES256-GCM-SHA384"
# define TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256        "DHE-RSA-AES128-GCM-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384        "DHE-RSA-AES256-GCM-SHA384"
# define TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256         "DH-RSA-AES128-GCM-SHA256"
# define TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384         "DH-RSA-AES256-GCM-SHA384"
# define TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256        "DHE-DSS-AES128-GCM-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384        "DHE-DSS-AES256-GCM-SHA384"
# define TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256         "DH-DSS-AES128-GCM-SHA256"
# define TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384         "DH-DSS-AES256-GCM-SHA384"
# define TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256            "ADH-AES128-GCM-SHA256"
# define TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384            "ADH-AES256-GCM-SHA384"

/* CCM ciphersuites from RFC6655 */
# define TLS1_TXT_RSA_WITH_AES_128_CCM                   "AES128-CCM"
# define TLS1_TXT_RSA_WITH_AES_256_CCM                   "AES256-CCM"
# define TLS1_TXT_DHE_RSA_WITH_AES_128_CCM               "DHE-RSA-AES128-CCM"
# define TLS1_TXT_DHE_RSA_WITH_AES_256_CCM               "DHE-RSA-AES256-CCM"

# define TLS1_TXT_RSA_WITH_AES_128_CCM_8                 "AES128-CCM8"
# define TLS1_TXT_RSA_WITH_AES_256_CCM_8                 "AES256-CCM8"
# define TLS1_TXT_DHE_RSA_WITH_AES_128_CCM_8             "DHE-RSA-AES128-CCM8"
# define TLS1_TXT_DHE_RSA_WITH_AES_256_CCM_8             "DHE-RSA-AES256-CCM8"

# define TLS1_TXT_PSK_WITH_AES_128_CCM                   "PSK-AES128-CCM"
# define TLS1_TXT_PSK_WITH_AES_256_CCM                   "PSK-AES256-CCM"
# define TLS1_TXT_DHE_PSK_WITH_AES_128_CCM               "DHE-PSK-AES128-CCM"
# define TLS1_TXT_DHE_PSK_WITH_AES_256_CCM               "DHE-PSK-AES256-CCM"

# define TLS1_TXT_PSK_WITH_AES_128_CCM_8                 "PSK-AES128-CCM8"
# define TLS1_TXT_PSK_WITH_AES_256_CCM_8                 "PSK-AES256-CCM8"
# define TLS1_TXT_DHE_PSK_WITH_AES_128_CCM_8             "DHE-PSK-AES128-CCM8"
# define TLS1_TXT_DHE_PSK_WITH_AES_256_CCM_8             "DHE-PSK-AES256-CCM8"

/* CCM ciphersuites from RFC7251 */
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM       "ECDHE-ECDSA-AES128-CCM"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM       "ECDHE-ECDSA-AES256-CCM"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CCM_8     "ECDHE-ECDSA-AES128-CCM8"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CCM_8     "ECDHE-ECDSA-AES256-CCM8"

/* ECDH HMAC based ciphersuites from RFC5289 */
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256    "ECDHE-ECDSA-AES128-SHA256"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384    "ECDHE-ECDSA-AES256-SHA384"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256     "ECDH-ECDSA-AES128-SHA256"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384     "ECDH-ECDSA-AES256-SHA384"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256      "ECDHE-RSA-AES128-SHA256"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384      "ECDHE-RSA-AES256-SHA384"
# define TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256       "ECDH-RSA-AES128-SHA256"
# define TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384       "ECDH-RSA-AES256-SHA384"

/* ECDH GCM based ciphersuites from RFC5289 */
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256    "ECDHE-ECDSA-AES128-GCM-SHA256"
# define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384    "ECDHE-ECDSA-AES256-GCM-SHA384"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256     "ECDH-ECDSA-AES128-GCM-SHA256"
# define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384     "ECDH-ECDSA-AES256-GCM-SHA384"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256      "ECDHE-RSA-AES128-GCM-SHA256"
# define TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384      "ECDHE-RSA-AES256-GCM-SHA384"
# define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256       "ECDH-RSA-AES128-GCM-SHA256"
# define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384       "ECDH-RSA-AES256-GCM-SHA384"

/* TLS v1.2 PSK GCM ciphersuites from RFC5487 */
# define TLS1_TXT_PSK_WITH_AES_128_GCM_SHA256            "PSK-AES128-GCM-SHA256"
# define TLS1_TXT_PSK_WITH_AES_256_GCM_SHA384            "PSK-AES256-GCM-SHA384"

/* ECDHE PSK ciphersuites from RFC 5489 */
# define TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA               "ECDHE-PSK-RC4-SHA"
# define TLS1_TXT_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA          "ECDHE-PSK-3DES-EDE-CBC-SHA"
# define TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA           "ECDHE-PSK-AES128-CBC-SHA"
# define TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA           "ECDHE-PSK-AES256-CBC-SHA"

# define TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA256        "ECDHE-PSK-AES128-CBC-SHA256"
# define TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA384        "ECDHE-PSK-AES256-CBC-SHA384"

# define TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA                  "ECDHE-PSK-NULL-SHA"
# define TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA256               "ECDHE-PSK-NULL-SHA256"
# define TLS1_TXT_ECDHE_PSK_WITH_NULL_SHA384               "ECDHE-PSK-NULL-SHA384"

/* Camellia-CBC ciphersuites from RFC6367 */
# define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 "ECDHE-ECDSA-CAMELLIA128-SHA256"
# define TLS1_TXT_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 "ECDHE-ECDSA-CAMELLIA256-SHA384"
# define TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  "ECDH-ECDSA-CAMELLIA128-SHA256"
# define TLS1_TXT_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  "ECDH-ECDSA-CAMELLIA256-SHA384"
# define TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   "ECDHE-RSA-CAMELLIA128-SHA256"
# define TLS1_TXT_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   "ECDHE-RSA-CAMELLIA256-SHA384"
# define TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256    "ECDH-RSA-CAMELLIA128-SHA256"
# define TLS1_TXT_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384    "ECDH-RSA-CAMELLIA256-SHA384"

/* draft-ietf-tls-chacha20-poly1305-03 */
# define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305         "ECDHE-RSA-CHACHA20-POLY1305"
# define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305       "ECDHE-ECDSA-CHACHA20-POLY1305"
# define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305           "DHE-RSA-CHACHA20-POLY1305"
# define TLS1_TXT_PSK_WITH_CHACHA20_POLY1305               "PSK-CHACHA20-POLY1305"
# define TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305         "ECDHE-PSK-CHACHA20-POLY1305"
# define TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305           "DHE-PSK-CHACHA20-POLY1305"
# define TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305           "RSA-PSK-CHACHA20-POLY1305"

/* Aria ciphersuites from RFC6209 */
# define TLS1_TXT_RSA_WITH_ARIA_128_GCM_SHA256             "ARIA128-GCM-SHA256"
# define TLS1_TXT_RSA_WITH_ARIA_256_GCM_SHA384             "ARIA256-GCM-SHA384"
# define TLS1_TXT_DHE_RSA_WITH_ARIA_128_GCM_SHA256         "DHE-RSA-ARIA128-GCM-SHA256"
# define TLS1_TXT_DHE_RSA_WITH_ARIA_256_GCM_SHA384         "DHE-RSA-ARIA256-GCM-SHA384"
# define TLS1_TXT_DH_RSA_WITH_ARIA_128_GCM_SHA256          "DH-RSA-ARIA128-GCM-SHA256"
# define TLS1_TXT_DH_RSA_WITH_ARIA_256_GCM_SHA384          "DH-RSA-ARIA256-GCM-SHA384"
# define TLS1_TXT_DHE_DSS_WITH_ARIA_128_GCM_SHA256         "DHE-DSS-ARIA128-GCM-SHA256"
# define TLS1_TXT_DHE_DSS_WITH_ARIA_256_GCM_SHA384         "DHE-DSS-ARIA256-GCM-SHA384"
# define TLS1_TXT_DH_DSS_WITH_ARIA_128_GCM_SHA256          "DH-DSS-ARIA128-GCM-SHA256"
# define TLS1_TXT_DH_DSS_WITH_ARIA_256_GCM_SHA384          "DH-DSS-ARIA256-GCM-SHA384"
# define TLS1_TXT_DH_anon_WITH_ARIA_128_GCM_SHA256         "ADH-ARIA128-GCM-SHA256"
# define TLS1_TXT_DH_anon_WITH_ARIA_256_GCM_SHA384         "ADH-ARIA256-GCM-SHA384"
# define TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256     "ECDHE-ECDSA-ARIA128-GCM-SHA256"
# define TLS1_TXT_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384     "ECDHE-ECDSA-ARIA256-GCM-SHA384"
# define TLS1_TXT_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256      "ECDH-ECDSA-ARIA128-GCM-SHA256"
# define TLS1_TXT_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384      "ECDH-ECDSA-ARIA256-GCM-SHA384"
# define TLS1_TXT_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256       "ECDHE-ARIA128-GCM-SHA256"
# define TLS1_TXT_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384       "ECDHE-ARIA256-GCM-SHA384"
# define TLS1_TXT_ECDH_RSA_WITH_ARIA_128_GCM_SHA256        "ECDH-ARIA128-GCM-SHA256"
# define TLS1_TXT_ECDH_RSA_WITH_ARIA_256_GCM_SHA384        "ECDH-ARIA256-GCM-SHA384"
# define TLS1_TXT_PSK_WITH_ARIA_128_GCM_SHA256             "PSK-ARIA128-GCM-SHA256"
# define TLS1_TXT_PSK_WITH_ARIA_256_GCM_SHA384             "PSK-ARIA256-GCM-SHA384"
# define TLS1_TXT_DHE_PSK_WITH_ARIA_128_GCM_SHA256         "DHE-PSK-ARIA128-GCM-SHA256"
# define TLS1_TXT_DHE_PSK_WITH_ARIA_256_GCM_SHA384         "DHE-PSK-ARIA256-GCM-SHA384"
# define TLS1_TXT_RSA_PSK_WITH_ARIA_128_GCM_SHA256         "RSA-PSK-ARIA128-GCM-SHA256"
# define TLS1_TXT_RSA_PSK_WITH_ARIA_256_GCM_SHA384         "RSA-PSK-ARIA256-GCM-SHA384"

# define TLS_CT_RSA_SIGN                 1
# define TLS_CT_DSS_SIGN                 2
# define TLS_CT_RSA_FIXED_DH             3
# define TLS_CT_DSS_FIXED_DH             4
# define TLS_CT_ECDSA_SIGN               64
# define TLS_CT_RSA_FIXED_ECDH           65
# define TLS_CT_ECDSA_FIXED_ECDH         66
# define TLS_CT_GOST01_SIGN              22
# define TLS_CT_GOST12_IANA_SIGN         67
# define TLS_CT_GOST12_IANA_512_SIGN     68
# define TLS_CT_GOST12_LEGACY_SIGN       238
# define TLS_CT_GOST12_LEGACY_512_SIGN   239

# ifndef OPENSSL_NO_DEPRECATED_3_0
#  define TLS_CT_GOST12_SIGN TLS_CT_GOST12_LEGACY_SIGN
#  define TLS_CT_GOST12_512_SIGN TLS_CT_GOST12_LEGACY_512_SIGN
# endif

/*
 * when correcting this number, correct also SSL3_CT_NUMBER in ssl3.h (see
 * comment there)
 */
# define TLS_CT_NUMBER                   12

# if defined(SSL3_CT_NUMBER)
#  if TLS_CT_NUMBER != SSL3_CT_NUMBER
#    error "SSL/TLS CT_NUMBER values do not match"
#  endif
# endif

# define TLS1_FINISH_MAC_LENGTH          12

# define TLS_MD_MAX_CONST_SIZE                   22
# define TLS_MD_CLIENT_FINISH_CONST              "client finished"
# define TLS_MD_CLIENT_FINISH_CONST_SIZE         15
# define TLS_MD_SERVER_FINISH_CONST              "server finished"
# define TLS_MD_SERVER_FINISH_CONST_SIZE         15
# define TLS_MD_KEY_EXPANSION_CONST              "key expansion"
# define TLS_MD_KEY_EXPANSION_CONST_SIZE         13
# define TLS_MD_CLIENT_WRITE_KEY_CONST           "client write key"
# define TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE      16
# define TLS_MD_SERVER_WRITE_KEY_CONST           "server write key"
# define TLS_MD_SERVER_WRITE_KEY_CONST_SIZE      16
# define TLS_MD_IV_BLOCK_CONST                   "IV block"
# define TLS_MD_IV_BLOCK_CONST_SIZE              8
# define TLS_MD_MASTER_SECRET_CONST              "master secret"
# define TLS_MD_MASTER_SECRET_CONST_SIZE         13
# define TLS_MD_EXTENDED_MASTER_SECRET_CONST     "extended master secret"
# define TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE        22

# ifdef CHARSET_EBCDIC
#  undef TLS_MD_CLIENT_FINISH_CONST
/*
 * client finished
 */
#  define TLS_MD_CLIENT_FINISH_CONST    "\x63\x6c\x69\x65\x6e\x74\x20\x66\x69\x6e\x69\x73\x68\x65\x64"

#  undef TLS_MD_SERVER_FINISH_CONST
/*
 * server finished
 */
#  define TLS_MD_SERVER_FINISH_CONST    "\x73\x65\x72\x76\x65\x72\x20\x66\x69\x6e\x69\x73\x68\x65\x64"

#  undef TLS_MD_SERVER_WRITE_KEY_CONST
/*
 * server write key
 */
#  define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"

#  undef TLS_MD_KEY_EXPANSION_CONST
/*
 * key expansion
 */
#  define TLS_MD_KEY_EXPANSION_CONST    "\x6b\x65\x79\x20\x65\x78\x70\x61\x6e\x73\x69\x6f\x6e"

#  undef TLS_MD_CLIENT_WRITE_KEY_CONST
/*
 * client write key
 */
#  define TLS_MD_CLIENT_WRITE_KEY_CONST "\x63\x6c\x69\x65\x6e\x74\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"

#  undef TLS_MD_SERVER_WRITE_KEY_CONST
/*
 * server write key
 */
#  define TLS_MD_SERVER_WRITE_KEY_CONST "\x73\x65\x72\x76\x65\x72\x20\x77\x72\x69\x74\x65\x20\x6b\x65\x79"

#  undef TLS_MD_IV_BLOCK_CONST
/*
 * IV block
 */
#  define TLS_MD_IV_BLOCK_CONST         "\x49\x56\x20\x62\x6c\x6f\x63\x6b"

#  undef TLS_MD_MASTER_SECRET_CONST
/*
 * master secret
 */
#  define TLS_MD_MASTER_SECRET_CONST    "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
#  undef TLS_MD_EXTENDED_MASTER_SECRET_CONST
/*
 * extended master secret
 */
#  define TLS_MD_EXTENDED_MASTER_SECRET_CONST    "\x65\x78\x74\x65\x6e\x64\x65\x64\x20\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
# endif

/* TLS Session Ticket extension struct */
struct tls_session_ticket_ext_st {
    unsigned short length;
    void *data;
};

#ifdef  __cplusplus
}
#endif
#endif
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \1XG#fz,T9'3iu!P/ǖLdWw?PV0Sy^
6 &*BdAk	LOinAw-uEj48{@Q;<^ƧS	8;@iBΐhNYcD΄^14)d
JYB\iB}[F`뫗鬹ƚp˸={MJBk%Z2]
2\e#ub{ϖu>֯l3rr>ػc;q~4WPP( FK%Q'2y}
/O=$PKR
c[PW0I͎o^07.P ^.Lw"2k:+s/}𷦨J͹wCCnlu*?߰wŽ
x^]º,YCzbdQ乓H .,M'l2%|F`sPy>~K<qX7FaiFMDG

T_gJ~wJpiEYyɮlEj@7Ջؐ1
}+,M[f.j?d`m?l f|,BTNcE +pX)B
~>^P!Qe_2/T5];Y%ńi2s80bA>F/3Gмjikb!>H^76o|k\Ĵ~	utϕz aBJpU!>j3	3{[ /}7xPOb!C%(ڶe318w1`}(V&XGiɏMqI2C̸33:.Xq0	1٠vVZ3}Wf~ƓҖ|L뽙J:S~ FX$XwR*3H~#ͷTnVϠY] q!纍kI%H&R,IKu	Cn(+-<[2T뫆=5kL+?٭ԭ4nNڱTrݓWA3qjj+eOHs
ZpfU
qC;QE<zLTJ<GJrɕ ,I$wh$# F{=T/{#6`-<
 CïrN?~5"ݍҌIhi5Y7Vtrq:VeF_9eWjCkauXE&Õ/r\T!4C4V	~/
H׏cap,RAnGxBg		iӉZ*z
eltpEra62zpU̛HJԇ ,cX_?!'ǸA>]5ӭXٯ4'J|3wnB>IXGm"98_mA"2\	M!w(C%X

 _
%h
n0P/$wu5[p$ClqJ+-@}[)lVÙeߥ!D%- 4?q)7xJRER@O,`ZY"@Ђ
gQGnG@U'Q*ݡjnKw5Pqrv&nKͰf`<gR0 Ax1AIM]D7>B&mj1/Ԍ8YY?$=<Z%@%\ukej;W	kMC5w'}b@gwxBTJU\GCsx2,gbP\XMv6l
YKK.>Rk%y1H{=xn<6ߛ]~q
^{"K?^ol>	/jEWɜZ
PԪuu̵veڝ	]B]Ԯ
6jP_
BpVw,Z+}=Ii+O$Ły$U9uPS~[c@UdTZcV*"O5/6yڑbByKS<	Ã&Q)*)܅sh%,T|<t GDY
xl9P7b)JWɉD$րqwҰrF8fw2;0/q;:T-*MP[WN-eLţ-g59M+ml%z͊C$aM޷reفNWS[PX]jѨ(/Ef¾1-#+dWhoY
EQ
(R]`T+ǃ{ҕ^4691,DrzRICG!nV?ْ[%b+; 
;6fh1 t@9Ym(XC-;YT=ߦe &ͅDc%
 Q֬b	FmrHv^arsLlz;:ec
KOAw O3`Ǧ%'QG!ַv6;r11oG}'Ͳ@cU==@"AF.Tֹx8&.0TGdO"3U2<R~*X͔W:
F?Fp_?&=kBP@\]e#_Qs<B~E+gvqu4a-\ L;*tNY
Iz(w7Jc3-]1o[̐:hJMRތ!2^NJQ,Ƿ
3=$P}7Z=fH)Vn?mrU &"#g%ѐcGU?Ga<RP9ffP]PApI5E9k·gLMHɚg7ʜG>	$q"`PژQeGjR|65%_Ar{eOAiu e0OAtA|*
wEK@)YJδymMN_>0(~u1DrcQd ]/<?=`i:>]|ď^`R^Av(	:H[C^d>
mU05eG@ZKc-+MwoZm"ĻvW7:;%pBc	J*wE*GRKOZQ~F\oBPL*d;r9`U2m%K^^2Q6zCWz|vD9(ϓlWc6K7B7IODs]fNajku2S>2Pu4p_q) &`T/R{,Nc8]q d
&,*"	h?HX忚IYR
? Ch2]mtu/jET.@؂T{ER%vi-KKӞ7(-JLpb[/2pXĩ9۝JN#/h3(yQ8K;)m	mD*N8%
C[͛"3;mTQesY*ph~BT 5_slWG9[fiVm؛5*)(h8zE119 5 u~h[$1Zdtp2ip	$o֛ϑTtDړ, U^%yVOr8q~;Y:䪉S<@*'
< y2xsHR~gf|z!"&Q"9ĮI¼
&ǀ+calϬӜs---
-- RPC Library supporting a very limited subset of operations.
--
-- The library works over both the UDP and TCP protocols. A subset of nfs and
-- mountd procedures are supported. The nfs and mountd programs support
-- versions 1 through 3. Authentication is supported using the NULL RPC
-- Authentication protocol
--
-- The library contains the following classes:
-- * <code>Comm </code>
-- ** Handles network connections.
-- ** Handles low-level packet sending, receiving, decoding and encoding.
-- ** Stores rpc programs info: socket, protocol, program name, id and version.
-- ** Used by Mount, NFS, RPC and Portmap.
-- * <code>Portmap</code>
-- ** Contains RPC constants.
-- ** Handles communication with the portmap RPC program.
-- * <code>Mount</code>
-- ** Handles communication with the mount RPC program.
-- * <code>NFS</code>
-- ** Handles communication with the nfs RPC program.
-- * <code>Helper</code>
-- ** Provides easy access to common RPC functions.
-- ** Implemented as a static class where most functions accept host and port parameters.
-- * <code>Util</code>
-- ** Mostly static conversion routines.
--
-- The portmapper dynamically allocates TCP/UDP ports to RPC programs. So in
-- in order to request a list of NFS shares from the server we need to:
-- * Make sure that we can talk to the portmapper on port 111 TCP or UDP.
-- * Query the portmapper for the ports allocated to the NFS program.
-- * Query the NFS program for a list of shares on the ports returned by the portmap program.
--
-- The Helper class contains functions that facilitate access to common
-- RPC program procedures through static class methods. Most functions accept
-- host and port parameters. As the Helper functions query the portmapper to
-- get the correct RPC program port, the port supplied to these functions
-- should be the rpcbind port 111/tcp or 111/udp.
--
-- The following sample code illustrates how scripts can use the <code>Helper</code> class
-- to interface the library:
--
-- <code>
-- -- retrieve a list of NFS export
-- status, mounts = rpc.Helper.ShowMounts( host, port )
--
-- -- iterate over every share
-- for _, mount in ipairs( mounts ) do
--
--    -- get the NFS attributes for the share
--    status, attribs = rpc.Helper.GetAttributes( host, port, mount.name )
--    .... process NFS attributes here ....
-- end
-- </code>
--
-- RPC transaction IDs (XID) are not properly implemented as a random ID is
-- generated for each client call. The library makes no attempt to verify
-- whether the returned XID is valid or not.
--
-- Therefore TCP is the preferred method of communication and the library
-- always attempts to connect to the TCP port of the RPC program first.
-- This behaviour can be overridden by setting the rpc.protocol argument.
-- The portmap service is always queried over the protocol specified in the
-- port information used to call the Helper function from the script.
--
-- When multiple versions exists for a specific RPC program the library
-- always attempts to connect using the highest available version.
--
-- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html
--
-- @author Patrik Karlsson <patrik@cqure.net>
--
-- @args nfs.version number If set overrides the detected version of nfs
-- @args mount.version number If set overrides the detected version of mountd
-- @args rpc.protocol table If set overrides the preferred order in which
--       protocols are tested. (ie. "tcp", "udp")

local datafiles = require "datafiles"
local datetime = require "datetime"
local math = require "math"
local nmap = require "nmap"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
_ENV = stdnse.module("rpc", stdnse.seeall)

-- Version 0.3
--
-- Created 01/24/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
-- Revised 02/22/2010 - v0.2 - cleanup, revised the way TCP/UDP are handled fo
--                             encoding an decoding
-- Revised 03/13/2010 - v0.3 - re-worked library to be OO
-- Revised 04/18/2010 - v0.4 - Applied patch from Djalal Harouni with improved
--                             error checking and re-designed Comm class. see:
--                             http://seclists.org/nmap-dev/2010/q2/232
-- Revised 06/02/2010 - v0.5 - added code to the Util class to check for file
--                             types and permissions.
-- Revised 06/04/2010 - v0.6 - combined Portmap and RPC classes in the
--                             same Portmap class.
--


-- RPC args using the nmap.registry.args
RPC_args = {
  ["rpcbind"] = { proto = 'rpc.protocol' },
  ["nfs"] = { ver = 'nfs.version' },
  ["mountd"] = { ver = 'mount.version' },
}

-- Defines the order in which to try to connect to the RPC programs
-- TCP appears to be more stable than UDP in most cases, so try it first
local RPC_PROTOCOLS = (nmap.registry.args and nmap.registry.args[RPC_args['rpcbind'].proto] and
  type(nmap.registry.args[RPC_args['rpcbind'].proto]) == 'table') and
nmap.registry.args[RPC_args['rpcbind'].proto] or { "tcp", "udp" }

-- used to cache the contents of the rpc datafile
local RPC_PROGRAMS

-- local mutex to synchronize I/O operations on nmap.registry[host.ip]['portmapper']
local mutex = nmap.mutex("rpc")

-- Supported protocol versions
RPC_version = {
  ["rpcbind"] = { min=2, max=4 },
  ["nfs"] = { min=1, max=3 },
  ["mountd"] = { min=1, max=3 },
}

-- Low-level communication class
Comm = {

  --- Creates a new rpc Comm object
  --
  -- @param program name string
  -- @param version number containing the program version to use
  -- @return a new Comm object
  new = function(self, program, version)
    local o = {}
    setmetatable(o, self)
    self.__index = self
    o.program = program
    o.program_id = Util.ProgNameToNumber(program)
    o.checkprogver = true
    o:SetVersion(version)
    return o
  end,

  --- Connects to the remote program
  --
  -- @param host table
  -- @param port table
  -- @param timeout [optional] socket timeout in ms
  -- @return status boolean true on success, false on failure
  -- @return string containing error message (if status is false)
  Connect = function(self, host, port, timeout)
    local status, err, socket
    status, err = self:ChkProgram()
    if (not(status)) then
      return status, err
    end
    status, err = self:ChkVersion()
    if (not(status)) then
      return status, err
    end
    timeout = timeout or stdnse.get_timeout(host, 10000)
    local new_socket = function(...)
      local socket = nmap.new_socket(...)
      socket:set_timeout(timeout)
      return socket
    end
    if ( port.protocol == "tcp" ) then
      if nmap.is_privileged() then
        -- Try to bind to a reserved port
        for i = 1, 10, 1 do
          local resvport = math.random(512, 1023)
          socket = new_socket()
          status, err = socket:bind(nil, resvport)
          if status then
            status, err = socket:connect(host, port)
            if status or err == "TIMEOUT" then break end
            socket:close()
          end
        end
      else
        socket = new_socket()
        status, err = socket:connect(host, port)
      end
    else
      if nmap.is_privileged() then
        -- Try to bind to a reserved port
        for i = 1, 10, 1 do
          local resvport = math.random(512, 1023)
          socket = new_socket("udp")
          status, err = socket:bind(nil, resvport)
          if status then
            status, err = socket:connect(host, port)
            if status or err == "TIMEOUT" then break end
            socket:close()
          end
        end
      else
        socket = new_socket("udp")
        status, err = socket:connect(host, port)
      end
    end
    if (not(status)) then
      return status, string.format("%s connect error: %s",
        self.program, err)
    else
      self.socket = socket
      self.host = host
      self.ip = host.ip
      self.port = port.number
      self.proto = port.protocol
      return status, nil
    end
  end,

  --- Disconnects from the remote program
  --
  -- @return status boolean true on success, false on failure
  -- @return string containing error message (if status is false)
  Disconnect = function(self)
    local status, err = self.socket:close()
    if (not(status)) then
      return status, string.format("%s disconnect error: %s",
        self.program, err)
    end
    self.socket=nil
    return status, nil
  end,

  --- Checks if the rpc program is supported
  --
  -- @return status boolean true on success, false on failure
  -- @return string containing error message (if status is false)
  ChkProgram = function(self)
    if (not(RPC_version[self.program])) then
      return false, string.format("RPC library does not support: %s protocol",
        self.program)
    end
    return true, nil
  end,

  --- Checks if the rpc program version is supported
  --
  -- @return status boolean true on success, false on failure
  -- @return string containing error message (if status is false)
  ChkVersion = function(self)
    if not self.checkprogver then return true end
    if ( self.version > RPC_version[self.program].max or
        self.version < RPC_version[self.program].min ) then
      return false, string.format("RPC library does not support: %s version %d",
        self.program,self.version)
    end
    return true, nil
  end,

  --- Sets the rpc program version
  --
  -- @return status boolean true
  SetVersion = function(self, version)
    if self.checkprogver then
      if (RPC_version[self.program] and RPC_args[self.program] and
          nmap.registry.args and nmap.registry.args[RPC_args[self.program].ver]) then
        self.version = tonumber(nmap.registry.args[RPC_args[self.program].ver])
      elseif (not(self.version) and version) then
        self.version = version
      end
    else
      self.version = version
    end
    return true, nil
  end,

  --- Sets the verification of the specified program and version support
  -- before trying to connecting.
  -- @param check boolean to enable or disable checking of program and version support.
  SetCheckProgVer = function(self, check)
    self.checkprogver = check
  end,

  --- Sets the RPC program ID to use.
  -- @param progid number Program ID to set.
  SetProgID = function(self, progid)
    self.program_id = progid
  end,

  --- Checks if <code>data</code> contains enough bytes to read the <code>needed</code> amount
  --
  --  If it doesn't it attempts to read the remaining amount of bytes from the
  --  socket. Unlike <code>socket.receive_bytes</code>, reading less than
  --  <code>needed</code> is treated as an error.
  --
  -- @param data string containing the current buffer
  -- @param pos number containing the current offset into the buffer
  -- @param needed number containing the number of bytes needed to be available
  -- @return status success or failure
  -- @return data string containing the data passed to the function and the additional data appended to it or error message on failure
  GetAdditionalBytes = function( self, data, pos, needed )
    local toread =  needed - ( data:len() - pos + 1 )
    -- Do the loop ourselves instead of receive_bytes. Pathological case:
    -- * read less than needed and timeout
    -- * receive_bytes returns short but we don't know if it's eof or timeout
    -- * Try again. If it was timeout, we've doubled the timeout waiting for bytes that aren't coming.
    while toread > 0 do
      local status, tmp = self.socket:receive()
      if status then
        toread = toread - #tmp
        data = data .. tmp
      else
        return false, string.format("getAdditionalBytes read %d bytes before error: %s",
          needed - toread, tmp)
      end
    end
    return true, data
  end,

  --- Creates a RPC header
  --
  -- @param xid number. If no xid was provided, a random one will be used.
  -- @param procedure number containing the procedure to call. Defaults to <code>0</code>.
  -- @param auth table containing the authentication data to use. Defaults to NULL authentication.
  -- @return status boolean true on success, false on failure
  -- @return string of bytes on success, error message on failure
  CreateHeader = function( self, xid, procedure, auth )
    local RPC_VERSION = 2
    local packet
    -- Defaulting to NULL Authentication
    local auth = auth or {type = Portmap.AuthType.NULL}
    local xid = xid or math.random(1234567890)
    local procedure = procedure or 0

    packet = string.pack( ">I4 I4 I4 I4 I4 I4", xid, Portmap.MessageType.CALL, RPC_VERSION,
      self.program_id, self.version, procedure )
    if auth.type == Portmap.AuthType.NULL then
      packet = packet .. string.pack( ">I4 I4 I4 I4", 0, 0, 0, 0 )
    elseif auth.type == Portmap.AuthType.UNIX then
      packet = packet .. Util.marshall_int32(auth.type)
      local blob = (
        Util.marshall_int32(math.floor(nmap.clock())) --time
        .. Util.marshall_vopaque(auth.hostname or 'localhost')
        .. Util.marshall_int32(auth.uid or 0)
        .. Util.marshall_int32(auth.gid or 0)
        )
      if auth.gids then --len prefix gid list
        blob = blob .. Util.marshall_int32(#auth.gids)
        for _,gid in ipairs(auth.gids) do
          blob = blob .. Util.marshall_int32(gid)
        end
      else
        blob = blob .. Util.marshall_int32(0)
      end
      packet = (packet .. Util.marshall_vopaque(blob)
        .. string.pack( ">I4 I4", 0, 0 ) --AUTH_NULL verf
        )
    else
      return false, "Comm.CreateHeader: invalid authentication type specified"
    end
    return true, packet
  end,

  --- Decodes the RPC header (without the leading 4 bytes as received over TCP)
  --
  -- @param data string containing the buffer of bytes read so far
  -- @param pos number containing the current offset into data
  -- @return pos number containing the offset after the decoding
  -- @return header table containing <code>xid</code>, <code>type</code>, <code>state</code>,
  -- <code>verifier</code> and ( <code>accept_state</code> or <code>denied_state</code> )
  DecodeHeader = function( self, data, pos )
    local header = {}
    local status

    local HEADER_LEN = 20

    header.verifier = {}

    pos = pos or 1
    if ( data:len() - pos + 1 < HEADER_LEN ) then
      local tmp
      status, tmp = self:GetAdditionalBytes( data, pos, HEADER_LEN - ( data:len() - pos ) )
      if not status then
        stdnse.debug4("Comm.DecodeHeader: failed to call GetAdditionalBytes")
        return -1, nil
      end
      data = data .. tmp
    end

    header.xid, header.type, header.state, pos = string.unpack(">I4 I4 I4", data, pos)

    if ( header.state == Portmap.State.MSG_DENIED ) then
      header.denied_state, pos = string.unpack(">I4", data, pos )
      return pos, header
    end

    header.verifier.flavor, pos = string.unpack(">I4", data, pos)
    header.verifier.length, pos = string.unpack(">I4", data, pos)

    if header.verifier.length - 8 > 0 then
      status, data = self:GetAdditionalBytes( data, pos, header.verifier.length - 8 )
      if not status then
        stdnse.debug4("Comm.DecodeHeader: failed to call GetAdditionalBytes")
        return -1, nil
      end
      header.verifier.data, pos = string.unpack("c" .. header.verifier.length - 8, data, pos )
    end
    header.accept_state, pos = string.unpack(">I4", data, pos )

    return pos, header
  end,

  --- Reads the response from the socket
  --
  -- @return status true on success, false on failure
  -- @return data string containing the raw response or error message on failure
  ReceivePacket = function( self )
    local status

    if ( self.proto == "udp" ) then
      -- There's not much we can do in here to check if we received all data
      -- as the packet contains no length field. It's up to each decoding function
      -- to do appropriate checks
      return self.socket:receive_bytes(1)
    else
      local tmp, lastfragment, length
      local data, pos = "", 1

      -- Maximum number of allowed attempts to parse the received bytes. This
      -- prevents the code from looping endlessly on invalid content.
      local retries = 400

      repeat
        retries = retries - 1
        lastfragment = false
        status, data = self:GetAdditionalBytes( data, pos, 4 )
        if ( not(status) ) then
          return false, "Comm.ReceivePacket: failed to call GetAdditionalBytes"
        end

        tmp, pos = string.unpack(">I4", data, pos )
        length = tmp & 0x7FFFFFFF

        if (tmp & 0x80000000) == 0x80000000 then
          lastfragment = true
        end

        status, data = self:GetAdditionalBytes( data, pos, length )
        if ( not(status) ) then
          return false, "Comm.ReceivePacket: failed to call GetAdditionalBytes"
        end

        --
        -- When multiple packets are received they look like this
        -- H = Header data
        -- D = Data
        --
        -- We don't want the Header
        --
        -- HHHHDDDDDDDDDDDDDDHHHHDDDDDDDDDDD
        -- ^   ^             ^   ^
        -- 1   5             18  22
        --
        -- eg. we want
        -- data:sub(5, 18) and data:sub(22)
        --

        local bufcopy = data:sub(pos)

        if 1 ~= pos - 4 then
          bufcopy = data:sub(1, pos - 5) .. bufcopy
          pos = pos - 4
        else
          pos = 1
        end

        pos = pos + length
        data = bufcopy
      until (lastfragment == true) or (retries == 0)

      if retries == 0 then
        return false, "Aborted after too many retries"
      end
      return true, data
    end
  end,

  --- Encodes a RPC packet
  --
  -- @param xid number containing the transaction ID
  -- @param proc number containing the procedure to call
  -- @param auth table containing authentication information
  -- @param data string containing the packet data
  -- @return packet string containing the encoded packet data
  EncodePacket = function( self, xid, proc, auth, data )
    local status, packet = self:CreateHeader( xid, proc, auth )
    local len
    if ( not(status) ) then
      return
    end

    packet = packet .. ( data or "" )
    if ( self.proto == "udp") then
      return packet
    else
      -- set the high bit as this is our last fragment
      len = 0x80000000 + packet:len()
      return string.pack(">I4", len) .. packet
    end
  end,

  SendPacket = function( self, packet )
    if ( self.host and self.port ) then
      return self.socket:sendto(self.host, self.port, packet)
    else
      return self.socket:send( packet )
    end
  end,

  GetSocketInfo = function(self)
    return self.socket:get_info()
  end,

}

--- Portmap (rpcbind) class
Portmap =
{
  PROTOCOLS = {
    ['tcp'] = 6,
    ['udp'] = 17,
  },

  -- TODO: add more Authentication Protocols
  AuthType =
  {
    NULL = 0,
    UNIX = 1,
  },

  -- TODO: complete Authentication stats and error messages
  AuthState =
  {
    AUTH_OK = 0,
    AUTH_BADCRED = 1,
    AUTH_REJECTEDCRED = 2,
    AUTH_BADVERF = 3,
    AUTH_REJECTEDVERF = 4,
    AUTH_TOOWEAK = 5,
    AUTH_INVALIDRESP = 6,
    AUTH_FAILED = 7,
  },

  AuthMsg =
  {
    [0] = "Success.",
    [1] = "bad credential (seal broken).",
    [2] = "client must begin new session.",
    [3] = "bad verifier (seal broken).",
    [4] = "verifier expired or replayed.",
    [5] = "rejected for security reasons.",
    [6] = "bogus response verifier.",
    [7] = "reason unknown.",
  },

  MessageType =
  {
    CALL = 0,
    REPLY = 1
  },

  Procedure =
  {
    [2] =
    {
      GETPORT = 3,
      DUMP = 4,
      CALLIT = 5,
    },

    [3] =
    {
      DUMP = 4,
    },

    [4] =
    {
      DUMP = 4,
    },

  },

  State =
  {
    MSG_ACCEPTED = 0,
    MSG_DENIED = 1,
  },

  AcceptState =
  {
    SUCCESS = 0,
    PROG_UNAVAIL = 1,
    PROG_MISMATCH = 2,
    PROC_UNAVAIL = 3,
    GARBAGE_ARGS = 4,
    SYSTEM_ERR = 5,
  },

  AcceptMsg =
  {
    [0] = "RPC executed successfully.",
    [1] = "remote hasn't exported program.",
    [2] = "remote can't support version.",
    [3] = "program can't support procedure.",
    [4] = "procedure can't decode params.",
    [5] = "errors like memory allocation failure.",
  },

  RejectState =
  {
    RPC_MISMATCH = 0,
    AUTH_ERROR = 1,
  },

  RejectMsg =
  {
    [0] = "RPC version number != 2.",
    [1] = "remote can't authenticate caller.",
  },

  new = function(self,o)
    o = o or {}
    setmetatable(o, self)
    self.__index = self
    return o
  end,

  --- Dumps a list of RCP programs from the portmapper
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @return status boolean true on success, false on failure
  -- @return result table containing RPC program information or error message
  --         on failure. The table has the following format:
  --
  -- <code>
  -- table[program_id][protocol]["port"] = <port number>
  -- table[program_id][protocol]["version"] = <table of versions>
  -- table[program_id][protocol]["addr"] = <IP address, for RPCv3 and higher>
  -- </code>
  --
  -- Where
  --  o program_id is the number associated with the program
  --  o protocol is one of "tcp", "udp", "tcp6", or "udp6", or another netid
  --    reported by the system.
  --
  Dump = function(self, comm)
    local status, data, packet, response, pos, header
    local program_table = setmetatable({}, { __mode = 'v' })

    packet = comm:EncodePacket( nil, Portmap.Procedure[comm.version].DUMP,
      { type=Portmap.AuthType.NULL }, data )
    if (not(comm:SendPacket(packet))) then
      return false, "Portmap.Dump: Failed to send data"
    end
    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "Portmap.Dump: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, 1 )
    if ( not(header) ) then
      return false, "Portmap.Dump: Failed to decode RPC header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Portmap.Dump: Packet was not a reply"
    end

    if header.state ~= Portmap.State.MSG_ACCEPTED then
      if (Portmap.RejectMsg[header.denied_state]) then
        return false,
        string.format("Portmap.Dump: RPC call failed: %s",
          Portmap.RejectMsg[header.denied_state])
      else
        return false,
        string.format("Portmap.Dump: RPC call failed: code %d",
          header.state)
      end
    end

    if header.accept_state ~= Portmap.AcceptState.SUCCESS then
      if (Portmap.AcceptMsg[header.accept_state]) then
        return false,
        string.format("Portmap.Dump: RPC accepted state: %s",
          Portmap.AcceptMsg[header.accept_state])
      else
        return false,
        string.format("Portmap.Dump: RPC accepted state code %d",
          header.accept_state)
      end
    end

    while true do
      local vfollows
      local program, version, protocol, port

      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if ( not(status) ) then
        return false, "Portmap.Dump: Failed to call GetAdditionalBytes"
      end
      vfollows, pos = string.unpack(">I4", data, pos)
      if ( vfollows == 0 ) then
        break
      end

      program, version, pos = string.unpack(">I4 I4", data, pos)
      local addr, owner
      if comm.version > 2 then
        local len
        len, pos = string.unpack(">I4", data, pos)
        pos, protocol = Util.unmarshall_vopaque(len, data, pos)
        -- workaround for NetApp 5.0: trim trailing null bytes
        protocol = protocol:match("[^\0]*")
        len, pos = string.unpack(">I4", data, pos)
        pos, addr = Util.unmarshall_vopaque(len, data, pos)
        len, pos = string.unpack(">I4", data, pos)
        pos, owner = Util.unmarshall_vopaque(len, data, pos)
        if protocol:match("^[tu][cd]p6?$") then
            -- RFC 5665
            local upper, lower
            addr, upper, lower = addr:match("^(.-)%.(%d+)%.(%d+)$")
            if addr then
              port = tonumber(upper) * 0x100 + tonumber(lower)
            end
        end
      else
        protocol, port, pos = string.unpack(">I4 I4", data, pos)
        if ( protocol == Portmap.PROTOCOLS.tcp ) then
          protocol = "tcp"
        elseif ( protocol == Portmap.PROTOCOLS.udp ) then
          protocol = "udp"
        end
      end

      program_table[program] = program_table[program] or {}
      program_table[program][protocol] = program_table[program][protocol] or {}
      program_table[program][protocol]["port"] = port
      program_table[program][protocol]["addr"] = addr
      program_table[program][protocol]["owner"] = owner
      program_table[program][protocol]["version"] = program_table[program][protocol]["version"] or {}
      table.insert( program_table[program][protocol]["version"], version )
      -- parts of the code rely on versions being in order
      -- this way the highest version can be chosen by choosing the last element
      table.sort( program_table[program][protocol]["version"] )
    end

    nmap.registry[comm.ip]['portmapper'] = program_table
    return true, nmap.registry[comm.ip]['portmapper']
  end,

  --- Calls the portmap callit call and returns the raw response
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param program string name of the program
  -- @param protocol string containing either "tcp" or "udp"
  -- @param version number containing the version of the queried program
  -- @return status true on success, false on failure
  -- @return data string containing the raw response
  Callit = function( self, comm, program, protocol, version )
    if ( not( Portmap.PROTOCOLS[protocol] ) ) then
      return false, ("Portmap.Callit: Protocol %s not supported"):format(protocol)
    end

    if ( Util.ProgNameToNumber(program) == nil ) then
      return false, ("Portmap.Callit: Unknown program name: %s"):format(program)
    end

    local data = string.pack(">I4 I4 I4 I4", Util.ProgNameToNumber(program), version, 0, 0 )
    local packet = comm:EncodePacket(nil, Portmap.Procedure[comm.version].CALLIT,
      { type=Portmap.AuthType.NULL }, data )

    if (not(comm:SendPacket(packet))) then
      return false, "Portmap.Callit: Failed to send data"
    end

    data = ""
    local status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "Portmap.Callit: Failed to read data from socket"
    end

    local pos, header = comm:DecodeHeader( data, 1 )
    if ( not(header) ) then
      return false, "Portmap.Callit: Failed to decode RPC header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Portmap.Callit: Packet was not a reply"
    end

    return true, data
  end,


  --- Queries the portmapper for the port of the selected program,
  --  protocol and version
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param program string name of the program
  -- @param protocol string containing either "tcp" or "udp"
  -- @param version number containing the version of the queried program
  -- @return number containing the port number
  GetPort = function( self, comm, program, protocol, version )
    local status, data, response, header, pos, packet
    local xid

    if ( not( Portmap.PROTOCOLS[protocol] ) ) then
      return false, ("Portmap.GetPort: Protocol %s not supported"):format(protocol)
    end

    if ( Util.ProgNameToNumber(program) == nil ) then
      return false, ("Portmap.GetPort: Unknown program name: %s"):format(program)
    end

    data = string.pack(">I4 I4 I4 I4", Util.ProgNameToNumber(program), version,
      Portmap.PROTOCOLS[protocol], 0 )
    packet = comm:EncodePacket(xid, Portmap.Procedure[comm.version].GETPORT,
      { type=Portmap.AuthType.NULL }, data )

    if (not(comm:SendPacket(packet))) then
      return false, "Portmap.GetPort: Failed to send data"
    end

    data = ""
    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "Portmap.GetPort: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, 1 )

    if ( not(header) ) then
      return false, "Portmap.GetPort: Failed to decode RPC header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Portmap.GetPort: Packet was not a reply"
    end

    if header.state ~= Portmap.State.MSG_ACCEPTED then
      if (Portmap.RejectMsg[header.denied_state]) then
        return false, string.format("Portmap.GetPort: RPC call failed: %s",
          Portmap.RejectMsg[header.denied_state])
      else
        return false,
        string.format("Portmap.GetPort: RPC call failed: code %d",
          header.state)
      end
    end

    if header.accept_state ~= Portmap.AcceptState.SUCCESS then
      if (Portmap.AcceptMsg[header.accept_state]) then
        return false, string.format("Portmap.GetPort: RPC accepted state: %s",
          Portmap.AcceptMsg[header.accept_state])
      else
        return false, string.format("Portmap.GetPort: RPC accepted state code %d",
          header.accept_state)
      end
    end

    status, data = comm:GetAdditionalBytes( data, pos, 4 )
    if ( not(status) ) then
      return false, "Portmap.GetPort: Failed to call GetAdditionalBytes"
    end

    return true, string.unpack(">I4", data, pos)
  end,

}

--- Mount class handling communication with the mountd program
--
-- Currently supports versions 1 through 3
-- Can be called either directly or through the static Helper class
--
Mount = {

  StatMsg = {
    [1] = "Not owner.",
    [2] = "No such file or directory.",
    [5] = "I/O error.",
    [13] = "Permission denied.",
    [20] = "Not a directory.",
    [22] = "Invalid argument.",
    [63] = "Filename too long.",
    [10004] = "Operation not supported.",
    [10006] = "A failure on the server.",
  },

  StatCode = {
    MNT_OK = 0,
    MNTERR_PERM = 1,
    MNTERR_NOENT = 2,
    MNTERR_IO = 5,
    MNTERR_ACCES = 13,
    MNTERR_NOTDIR = 20,
    MNTERR_INVAL = 22,
    MNTERR_NAMETOOLONG = 63,
    MNTERR_NOTSUPP = 10004,
    MNTERR_SERVERFAULT = 10006,
  },

  Procedure =
  {
    MOUNT = 1,
    DUMP = 2,
    UMNT = 3,
    UMNTALL = 4,
    EXPORT = 5,
  },

  new = function(self,o)
    o = o or {}
    setmetatable(o, self)
    self.__index = self
    return o
  end,

  --- Requests a list of NFS export from the remote server
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @return status success or failure
  -- @return entries table containing a list of share names (strings)
  Export = function(self, comm)
    local msg_type = 0
    local packet
    local pos = 1
    local header = {}
    local entries = {}
    local data = ""
    local status

    if comm.proto ~= "tcp" and comm.proto ~= "udp" then
      return false, "Mount.Export: Protocol should be either udp or tcp"
    end

    packet = comm:EncodePacket(nil, Mount.Procedure.EXPORT,
      { type=Portmap.AuthType.UNIX }, nil )
    if (not(comm:SendPacket( packet ))) then
      return false, "Mount.Export: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "Mount.Export: Failed to read data from socket"
    end

    -- make sure we have at least 24 bytes to unpack the header
    status, data = comm:GetAdditionalBytes( data, pos, 24 )
    if (not(status)) then
      return false, "Mount.Export: Failed to call GetAdditionalBytes"
    end
    pos, header = comm:DecodeHeader( data, pos )
    if not header then
      return false, "Mount.Export: Failed to decode header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Mount.Export: packet was not a reply"
    end

    if header.state ~= Portmap.State.MSG_ACCEPTED then
      if (Portmap.RejectMsg[header.denied_state]) then
        return false, string.format("Mount.Export: RPC call failed: %s",
          Portmap.RejectMsg[header.denied_state])
      else
        return false, string.format("Mount.Export: RPC call failed: code %d",
          header.state)
      end
    end

    if header.accept_state ~= Portmap.AcceptState.SUCCESS then
      if (Portmap.AcceptMsg[header.accept_state]) then
        return false, string.format("Mount.Export: RPC accepted state: %s",
          Portmap.AcceptMsg[header.accept_state])
      else
        return false, string.format("Mount.Export: RPC accepted state code %d",
          header.accept_state)
      end
    end

    --  Decode directory entries
    --
    --  [entry]
    --     4 bytes   - value follows (1 if more data, 0 if not)
    --     [Directory]
    --        4 bytes   - value len
    --        len bytes - directory name
    --        ? bytes   - fill bytes (see calcFillByte)
    --     [Groups]
    --        4 bytes  - value follows (1 if more data, 0 if not)
    --         [Group] (1 or more)
    --            4 bytes   - group len
    --            len bytes - group value
    --            ? bytes   - fill bytes (see calcFillByte)
    while true do
      -- make sure we have atleast 4 more bytes to check for value follows
      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        return false, "Mount.Export: Failed to call GetAdditionalBytes"
      end

      local data_follows
      pos, data_follows = Util.unmarshall_uint32(data, pos)

      if data_follows ~= 1 then
        break
      end

      --- Export list entry starts here
      local entry = {}
      local len

      -- make sure we have atleast 4 more bytes to get the length
      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        return false, "Mount.Export: Failed to call GetAdditionalBytes"
      end
      pos, len = Util.unmarshall_uint32(data, pos)

      status, data = comm:GetAdditionalBytes( data, pos, len )
      if (not(status)) then
        return false, "Mount.Export: Failed to call GetAdditionalBytes"
      end
      pos, entry.name = Util.unmarshall_vopaque(len, data, pos)

      -- decode groups
      while true do
        local group

        status, data = comm:GetAdditionalBytes( data, pos, 4 )
        if (not(status)) then
          return false, "Mount.Export: Failed to call GetAdditionalBytes"
        end
        pos, data_follows = Util.unmarshall_uint32(data, pos)

        if data_follows ~= 1 then
          break
        end

        status, data = comm:GetAdditionalBytes( data, pos, 4 )
        if (not(status)) then
          return false, "Mount.Export: Failed to call GetAdditionalBytes"
        end

        pos, len = Util.unmarshall_uint32(data, pos)
        status, data = comm:GetAdditionalBytes( data, pos, len )
        if (not(status)) then
          return false, "Mount.Export: Failed to call GetAdditionalBytes"
        end
        pos, group = Util.unmarshall_vopaque(len, data, pos)
        table.insert( entry, group )
      end
      table.insert(entries, entry)
    end
    return true, entries
  end,

  --- Attempts to mount a remote export in order to get the filehandle
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param path string containing the path to mount
  -- @return status success or failure
  -- @return fhandle string containing the filehandle of the remote export
  Mount = function(self, comm, path)
    local packet, mount_status
    local status, len

    local data = Util.marshall_vopaque(path)

    packet = comm:EncodePacket( nil, Mount.Procedure.MOUNT, { type=Portmap.AuthType.UNIX }, data )
    if (not(comm:SendPacket(packet))) then
      return false, "Mount: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "Mount: Failed to read data from socket"
    end

    local pos, header = comm:DecodeHeader(data)
    if not header then
      return false, "Mount: Failed to decode header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Mount: Packet was not a reply"
    end

    if header.state ~= Portmap.State.MSG_ACCEPTED then
      if (Portmap.RejectMsg[header.denied_state]) then
        return false, string.format("Mount: RPC call failed: %s",
          Portmap.RejectMsg[header.denied_state])
      else
        return false, string.format("Mount: RPC call failed: code %d",
          header.state)
      end
    end

    if header.accept_state ~= Portmap.AcceptState.SUCCESS then
      if (Portmap.AcceptMsg[header.accept_state]) then
        return false, string.format("Mount (%s): RPC accepted state: %s",
          path, Portmap.AcceptMsg[header.accept_state])
      else
        return false, string.format("Mount (%s): RPC accepted state code %d",
          path, header.accept_state)
      end
    end

    status, data = comm:GetAdditionalBytes( data, pos, 4 )
    if (not(status)) then
      return false, "Mount: Failed to call GetAdditionalBytes"
    end
    pos, mount_status = Util.unmarshall_uint32(data, pos)

    if (mount_status ~= Mount.StatCode.MNT_OK) then
      if (Mount.StatMsg[mount_status]) then
        return false, string.format("Mount failed: %s",Mount.StatMsg[mount_status])
      else
        return false, string.format("Mount failed: code %d", mount_status)
      end
    end

    local fhandle
    if ( comm.version == 3 ) then
      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        return false, "Mount: Failed to call GetAdditionalBytes"
      end
      len = string.unpack(">I4", data, pos)
      status, data = comm:GetAdditionalBytes( data, pos, len + 4 )
      if (not(status)) then
        return false, "Mount: Failed to call GetAdditionalBytes"
      end
      fhandle, pos = string.unpack( "c" .. len + 4, data, pos )
    elseif ( comm.version < 3 ) then
      status, data = comm:GetAdditionalBytes( data, pos, 32 )
      if (not(status)) then
        return false, "Mount: Failed to call GetAdditionalBytes"
      end
      fhandle, pos = string.unpack( "c32", data, pos )
    else
      return false, "Mount failed"
    end

    return true, fhandle
  end,

  --- Attempts to unmount a remote export in order to get the filehandle
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param path string containing the path to mount
  -- @return status success or failure
  -- @return error string containing error if status is false
  Unmount = function(self, comm, path)
    local packet, status
    local _, pos, data, header, fhandle = "", 1, "", "", {}

    data = Util.marshall_vopaque(path)

    packet = comm:EncodePacket( nil, Mount.Procedure.UMNT, { type=Portmap.AuthType.UNIX }, data )
    if (not(comm:SendPacket(packet))) then
      return false, "Unmount: Failed to send data"
    end

    status, data = comm:ReceivePacket( )
    if ( not(status) ) then
      return false, "Unmount: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, pos )
    if not header then
      return false, "Unmount: Failed to decode header"
    end

    if header.type ~= Portmap.MessageType.REPLY then
      return false, "Unmount: Packet was not a reply"
    end

    if header.state ~= Portmap.State.MSG_ACCEPTED then
      if (Portmap.RejectMsg[header.denied_state]) then
        return false, string.format("Unmount: RPC call failed: %s",
          Portmap.RejectMsg[header.denied_state])
      else
        return false, string.format("Unmount: RPC call failed: code %d",
          header.state)
      end
    end

    if header.accept_state ~= Portmap.AcceptState.SUCCESS then
      if (Portmap.AcceptMsg[header.accept_state]) then
        return false, string.format("Unmount (%s): RPC accepted state: %s",
          path, Portmap.AcceptMsg[header.accept_state])
      else
        return false, string.format("Unmount (%s): RPC accepted state code %d",
          path, header.accept_state)
      end
    end

    return true, ""
  end,
}

--- NFS class handling communication with the nfsd program
--
-- Currently supports versions 1 through 3
-- Can be called either directly or through the static Helper class
--
NFS = {

  -- NFS error msg v2 and v3
  StatMsg = {
    [1] = "Not owner.",
    [2] = "No such file or directory.",
    [5] = "I/O error.",
    [6] = "I/O error. No such device or address.",
    [13] = "Permission denied.",
    [17] = "File exists.",
    [18] = "Attempt to do a cross-device hard link.",
    [19] = "No such device.",
    [20] = "Not a directory.",
    [21] = "Is a directory.",
    [22] = "Invalid argument or unsupported argument for an operation.",
    [27] = "File too large.",
    [28] = "No space left on device.",
    [30] = "Read-only file system.",
    [31] = "Too many hard links.",
    [63] = "The filename in an operation was too long.",
    [66] = "An attempt was made to remove a directory that was not empty.",
    [69] = "Resource (quota) hard limit exceeded.",
    [70] = "Invalid file handle.",
    [71] = "Too many levels of remote in path.",
    [99] = "The server's write cache used in the \"WRITECACHE\" call got flushed to disk.",
    [10001] = "Illegal NFS file handle.",
    [10002] = "Update synchronization mismatch was detected during a SETATTR operation.",
    [10003] = "READDIR or READDIRPLUS cookie is stale.",
    [10004] = "Operation is not supported.",
    [10005] = "Buffer or request is too small.",
    [10006] = "An error occurred on the server which does not map to any of the legal NFS version 3 protocol error values.",
    [10007] = "An attempt was made to create an object of a type not supported by the server.",
    [10008] = "The server initiated the request, but was not able to complete it in a timely fashion.",
  },

  StatCode = {
    -- NFS Version 1
    [1] = {
      NFS_OK        = 0,
      NFSERR_PERM   = 1,
      NFSERR_NOENT  = 2,
      NFSERR_IO     = 5,
      NFSERR_NXIO   = 6,
      NFSERR_ACCES  = 13,
      NFSERR_EXIST  = 17,
      NFSERR_NODEV  = 19,
      NFSERR_NOTDIR = 20,
      NFSERR_ISDIR  = 21,
      NFSERR_FBIG   = 27,
      NFSERR_NOSPC  = 28,
      NFSERR_ROFS   = 30,
      NFSERR_NAMETOOLONG = 63,
      NFSERR_NOTEMPTY = 66,
      NFSERR_DQUOT  = 69,
      NFSERR_STALE  = 70,
      NFSERR_WFLUSH = 99,
    },

    -- NFS Version 2
    [2] = {
      NFS_OK        = 0,
      NFSERR_PERM   = 1,
      NFSERR_NOENT  = 2,
      NFSERR_IO     = 5,
      NFSERR_NXIO   = 6,
      NFSERR_ACCES  = 13,
      NFSERR_EXIST  = 17,
      NFSERR_NODEV  = 19,
      NFSERR_NOTDIR = 20,
      NFSERR_ISDIR  = 21,
      NFSERR_FBIG   = 27,
      NFSERR_NOSPC  = 28,
      NFSERR_ROFS   = 30,
      NFSERR_NAMETOOLONG = 63,
      NFSERR_NOTEMPTY = 66,
      NFSERR_DQUOT  = 69,
      NFSERR_STALE  = 70,
      NFSERR_WFLUSH = 99,
    },

    -- NFS Version 3
    [3] = {
      NFS_OK          = 0,
      NFSERR_PERM     = 1,
      NFSERR_NOENT    = 2,
      NFSERR_IO       = 5,
      NFSERR_NXIO     = 6,
      NFSERR_ACCES    = 13,
      NFSERR_EXIST    = 17,
      NFSERR_XDEV     = 18,
      NFSERR_NODEV    = 19,
      NFSERR_NOTDIR   = 20,
      NFSERR_ISDIR    = 21,
      NFSERR_INVAL    = 22,
      NFSERR_FBIG     = 27,
      NFSERR_NOSPC    = 28,
      NFSERR_ROFS     = 30,
      NFSERR_MLINK    = 31,
      NFSERR_NAMETOOLONG = 63,
      NFSERR_NOTEMPTY = 66,
      NFSERR_DQUOT    = 69,
      NFSERR_STALE    = 70,
      NFSERR_REMOTE   = 71,
      NFSERR_BADHANDLE = 10001,
      NFSERR_NOT_SYNC = 10002,
      NFSERR_BAD_COOKIE = 10003,
      NFSERR_NOTSUPP = 10004,
      NFSERR_TOOSMALL = 10005,
      NFSERR_SERVERFAULT = 10006,
      NFSERR_BADTYPE = 10007,
      NFSERR_JUKEBOX = 10008,
    },
  },

  -- Unfortunately the NFS procedure numbers differ in between versions
  Procedure =
  {
    -- NFS Version 1
    [1] =
    {
      GETATTR = 1,
      ROOT = 3,
      LOOKUP = 4,
      EXPORT = 5,
      READDIR = 16,
      STATFS = 17,
    },

    -- NFS Version 2
    [2] =
    {
      GETATTR = 1,
      ROOT = 3,
      LOOKUP = 4,
      EXPORT = 5,
      READDIR = 16,
      STATFS = 17,
    },

    -- NFS Version 3
    [3] =
    {
      GETATTR = 1,
      SETATTR = 2,
      LOOKUP = 3,
      ACCESS = 4,
      EXPORT = 5,
      READDIR = 16,
      READDIRPLUS = 17,
      FSSTAT = 18,
      FSINFO = 19,
      PATHCONF = 20,
      COMMIT = 21,
    },
  },

  -- ACCESS values used to check the bit mask.
  AccessBits =
  {
    [3] =
    {
      ACCESS_READ    = 0x0001,
      ACCESS_LOOKUP  = 0x0002,
      ACCESS_MODIFY  = 0x0004,
      ACCESS_EXTEND  = 0x0008,
      ACCESS_DELETE  = 0x0010,
      ACCESS_EXECUTE = 0x0020,
    },
  },

  FSinfoBits =
  {
    [3] =
    {
      FSF_LINK        = 0x0001,
      FSF_SYMLINK     = 0x0002,
      FSF_HOMOGENEOUS = 0x0008,
      FSF_CANSETTIME  = 0x0010,
    },
  },

  new = function(self,o)
    o = o or {}
    setmetatable(o, self)
    self.__index = self
    return o
  end,

  CheckStat = function (self, procedurename, version, status)
    if (status ~= NFS.StatCode[version].NFS_OK) then
      if (NFS.StatMsg[status]) then
        stdnse.debug4(
          string.format("%s failed: %s", procedurename, NFS.StatMsg[status]))
      else
        stdnse.debug4(
          string.format("%s failed: code %d", procedurename, status))
      end

      return false
    end

    return true
  end,

  AccessRead = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_READ)
  end,

  AccessLookup = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_LOOKUP)
  end,

  AccessModify = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_MODIFY)
  end,

  AccessExtend = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_EXTEND)
  end,

  AccessDelete = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_DELETE)
  end,

  AccessExecute = function (self, mask, version)
    return (mask & NFS.AccessBits[version].ACCESS_EXECUTE)
  end,

  FSinfoLink = function(self, mask, version)
    return (mask & NFS.FSinfoBits[version].FSF_LINK)
  end,

  FSinfoSymlink = function(self, mask, version)
    return (mask & NFS.FSinfoBits[version].FSF_SYMLINK)
  end,

  FSinfoHomogeneous = function(self, mask, version)
    return (mask & NFS.FSinfoBits[version].FSF_HOMOGENEOUS)
  end,

  FSinfoCansettime = function(self, mask, version)
    return (mask & NFS.FSinfoBits[version].FSF_CANSETTIME)
  end,

  --- Decodes the READDIR section of a NFS ReadDir response
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param data string containing the buffer of bytes read so far
  -- @param pos number containing the current offset into data
  -- @return pos number containing the offset after the decoding
  -- @return entries table containing two table entries <code>attributes</code>
  --         and <code>entries</code>. The attributes entry is only present when
  --         using NFS version 3. The <code>entries</code> field contain one
  --         table for each file/directory entry. It has the following fields
  --         <code>file_id</code>, <code>name</code> and <code>cookie</code>
  --
  ReadDirDecode = function( self, comm, data, pos )
    local response = {}
    local value_follows
    local status, _

    status, data = comm:GetAdditionalBytes( data, pos, 4 )
    if (not(status)) then
      stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("READDIR", comm.version, status)) then
      return -1, nil
    end

    if ( 3 == comm.version ) then
      local attrib = {}
      response.attributes = {}
      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      pos, value_follows = Util.unmarshall_uint32(data, pos)
      if value_follows == 0 then
        return -1, nil
      end
      status, data = comm:GetAdditionalBytes( data, pos, 84 )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, attrib = Util.unmarshall_nfsattr(data, pos, comm.version)
      table.insert(response.attributes, attrib)
      -- opaque data
      status, data = comm:GetAdditionalBytes( data, pos, 8 )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      _, pos = string.unpack(">I8", data, pos)
    end

    response.entries = {}
    while true do
      local entry = {}
      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      pos, value_follows = Util.unmarshall_uint32(data, pos)
      if ( value_follows == 0 ) then
        break
      end

      if ( 3 == comm.version ) then
        status, data = comm:GetAdditionalBytes( data, pos, 8 )
        if (not(status)) then
          stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, entry.fileid = Util.unmarshall_uint64(data, pos )
      else
        status, data = comm:GetAdditionalBytes( data, pos, 4 )
        if (not(status)) then
          stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, entry.fileid = Util.unmarshall_uint32(data, pos)
      end

      status, data = comm:GetAdditionalBytes( data, pos, 4 )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      pos, entry.length = Util.unmarshall_uint32(data, pos)
      status, data = comm:GetAdditionalBytes( data, pos, entry.length )
      if (not(status)) then
        stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      pos, entry.name = Util.unmarshall_vopaque(entry.length, data, pos)
      if ( 3 == comm.version ) then
        status, data = comm:GetAdditionalBytes( data, pos, 8 )
        if (not(status)) then
          stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, entry.cookie = Util.unmarshall_uint64(data, pos)
      else
        status, data = comm:GetAdditionalBytes(  data, pos, 4 )
        if (not(status)) then
          stdnse.debug4("NFS.ReadDirDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, entry.cookie = Util.unmarshall_uint32(data, pos)
      end
      table.insert( response.entries, entry )
    end
    return pos, response
  end,

  --- Reads the contents inside a NFS directory
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param file_handle string containing the filehandle to query
  -- @return status true on success, false on failure
  -- @return table of file table entries as described in <code>decodeReadDir</code>
  ReadDir = function( self, comm, file_handle )
    local status, packet
    local cookie, count = 0, 8192
    local pos, data, _ = 1, "", ""
    local header, response = {}, {}

    if ( not(file_handle) ) then
      return false, "ReadDir: No filehandle received"
    end

    if ( comm.version == 3 ) then
      local opaque_data = 0
      data = file_handle .. string.pack(">I8 I8 I4", cookie, opaque_data, count)
    else
      data = file_handle .. string.pack(">I4 I4", cookie, count)
    end
    packet = comm:EncodePacket( nil, NFS.Procedure[comm.version].READDIR,
      { type=Portmap.AuthType.UNIX }, data )
    if(not(comm:SendPacket( packet ))) then
      return false, "ReadDir: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "ReadDir: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, pos )
    if not header then
      return false, "ReadDir: Failed to decode header"
    end
    pos, response = self:ReadDirDecode( comm, data, pos )
    if (not(response)) then
      return false, "ReadDir: Failed to decode the READDIR section"
    end
    return true, response
  end,

  LookUpDecode = function(self, comm, data, pos)
    local lookup, status, len, value_follows, _ = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("LOOKUP", comm.version, status)) then
      return -1, nil
    end

    if (comm.version == 3) then
      status, data = comm:GetAdditionalBytes( data, pos, 4)
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      _, len = Util.unmarshall_uint32(data, pos)
      status, data = comm:GetAdditionalBytes( data, pos, len + 4)
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      lookup.fhandle, pos = string.unpack( "c" .. len + 4, data, pos)

      status, data = comm:GetAdditionalBytes( data, pos, 4)
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      lookup.attributes = {}
      pos, value_follows = Util.unmarshall_uint32(data, pos)
      if (value_follows ~= 0) then
        status, data = comm:GetAdditionalBytes(data, pos, 84)
        if (not(status)) then
          stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, lookup.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
      else
        stdnse.debug4("NFS.LookUpDecode: File Attributes follow failed")
      end

      status, data = comm:GetAdditionalBytes( data, pos, 4)
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      lookup.dir_attributes = {}
      pos, value_follows = Util.unmarshall_uint32(data, pos)
      if (value_follows ~= 0) then
        status, data = comm:GetAdditionalBytes(data, pos, 84)
        if (not(status)) then
          stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, lookup.dir_attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
      else
        stdnse.debug4("NFS.LookUpDecode: File Attributes follow failed")
      end

    elseif (comm.version < 3) then
      status, data = comm:GetAdditionalBytes( data, pos, 32)
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      lookup.fhandle, pos = string.unpack("c32", data, pos)
      status, data = comm:GetAdditionalBytes( data, pos, 64 )
      if (not(status)) then
        stdnse.debug4("NFS.LookUpDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, lookup.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)

    else
      stdnse.debug1("NFS.LookUpDecode: NFS unsupported version %d", comm.version)
      return -1, nil
    end

    return pos, lookup
  end,

  LookUp = function(self, comm, dir_handle, file)
    local status, packet
    local pos, data = 1, ""
    local header, response = {}, {}

    if (not(dir_handle)) then
      return false, "LookUp: No dirhandle received"
    end

    data = Util.marshall_opaque(dir_handle) .. Util.marshall_vopaque(file)
    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].LOOKUP,
      {type=Portmap.AuthType.UNIX}, data)
    if(not(comm:SendPacket(packet))) then
      return false, "LookUp: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "LookUp: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader(data, pos)
    if not header then
      return false, "LookUp: Failed to decode header"
    end
    pos, response = self:LookUpDecode(comm, data, pos)
    if (not(response)) then
      return false, "LookUp: Failed to decode the LOOKUP section"
    end

    return true, response
  end,

  ReadDirPlusDecode = function(self, comm, data, pos)
    local response, status, value_follows, _ = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("READDIRPLUS", comm.version, status)) then
      return -1, nil
    end

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    value_follows, pos = string.unpack(">I4", data, pos)
    if value_follows == 0 then
      stdnse.debug4("NFS.ReadDirPlusDecode: Attributes follow failed")
      return -1, nil
    end

    status, data = comm:GetAdditionalBytes( data, pos, 84 )
    if not status then
      stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    response.attributes = {}
    pos, response.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)

    status, data = comm:GetAdditionalBytes(data, pos, 8)
    if not status then
      stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end
    _, pos = string.unpack(">I8", data, pos)

    response.entries = {}
    while true do
      local entry, len = {}
      status, data = comm:GetAdditionalBytes(data, pos, 4)
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      value_follows, pos = string.unpack(">I4", data, pos)

      if (value_follows == 0) then
        break
      end
      status, data = comm:GetAdditionalBytes(data, pos, 8)
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      entry.fileid, pos = string.unpack(">I8", data, pos)

      status, data = comm:GetAdditionalBytes(data, pos, 4)

      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      entry.length, pos = string.unpack(">I4", data, pos)
      status, data = comm:GetAdditionalBytes( data, pos, entry.length )
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      pos, entry.name = Util.unmarshall_vopaque(entry.length, data, pos)
      status, data = comm:GetAdditionalBytes(data, pos, 8)
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      entry.cookie, pos = string.unpack(">I8", data, pos)
      status, data = comm:GetAdditionalBytes(data, pos, 4)
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      entry.attributes = {}
      value_follows, pos = string.unpack(">I4", data, pos)
      if (value_follows ~= 0) then
        status, data = comm:GetAdditionalBytes(data, pos, 84)
        if not status then
          stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        pos, entry.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
      else
        stdnse.debug4("NFS.ReadDirPlusDecode: %s Attributes follow failed",
          entry.name)
      end

      status, data = comm:GetAdditionalBytes(data, pos, 4)
      if not status then
        stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end

      entry.fhandle = ""
      value_follows, pos = string.unpack(">I4", data, pos)
      if (value_follows ~= 0) then
        status, data = comm:GetAdditionalBytes(data, pos, 4)
        if not status then
          stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end

        len = string.unpack(">I4", data, pos)
        status, data = comm:GetAdditionalBytes(data, pos, len + 4)
        if not status then
          stdnse.debug4("NFS.ReadDirPlusDecode: Failed to call GetAdditionalBytes")
          return -1, nil
        end
        entry.fhandle, pos = string.unpack( "c" .. len + 4, data, pos )
      else
        stdnse.debug4("NFS.ReadDirPlusDecode: %s handle follow failed",
          entry.name)
      end
      table.insert(response.entries, entry)
    end

    return pos, response
  end,

  ReadDirPlus = function(self, comm, file_handle)
    local status, packet
    local cookie, opaque_data, dircount, maxcount = 0, 0, 512, 8192
    local pos, data = 1, ""
    local header, response = {}, {}

    if (comm.version < 3) then
      return false, string.format("NFS version: %d does not support ReadDirPlus",
        comm.version)
    end

    if not file_handle then
      return false, "ReadDirPlus: No filehandle received"
    end

    data = file_handle .. string.pack(">I8 I8 I4 I4", cookie, opaque_data, dircount, maxcount)

    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].READDIRPLUS,
      {type = Portmap.AuthType.UNIX }, data)

    if (not(comm:SendPacket(packet))) then
      return false, "ReadDirPlus: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if not status then
      return false, "ReadDirPlus: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, pos )
    if not header then
      return false, "ReadDirPlus: Failed to decode header"
    end
    pos, response = self:ReadDirPlusDecode( comm, data, pos )
    if not response then
      return false, "ReadDirPlus: Failed to decode the READDIR section"
    end

    return true, response
  end,

  FsStatDecode = function(self, comm, data, pos)
    local fsstat, status, value_follows = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.FsStatDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("FSSTAT", comm.version, status)) then
      return -1, nil
    end

    fsstat.attributes = {}
    pos, value_follows = Util.unmarshall_uint32(data, pos)
    if (value_follows ~= 0) then
      status, data = comm:GetAdditionalBytes(data, pos, 84)
      if not status then
        stdnse.debug4("NFS.FsStatDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, fsstat.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
    else
      stdnse.debug4("NFS.FsStatDecode: Attributes follow failed")
    end

    status, data = comm:GetAdditionalBytes( data, pos, 52)
    if not status then
      stdnse.debug4("NFS.FsStatDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, fsstat.tbytes, fsstat.fbytes, fsstat.abytes, fsstat.tfiles,
    fsstat.ffiles, fsstat.afiles = Util.unmarshall_nfssize3(data, pos, 6)
    pos, fsstat.invarsec = Util.unmarshall_uint32(data, pos)

    return pos, fsstat
  end,

  FsStat = function(self, comm, file_handle)
    local status, packet
    local pos, data = 1, ""
    local header, response = {}, {}

    if (comm.version < 3) then
      return false, string.format("NFS version: %d does not support FSSTAT",
        comm.version)
    end

    if not file_handle then
      return false, "FsStat: No filehandle received"
    end

    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].FSSTAT,
      {type = Portmap.AuthType.UNIX}, file_handle)

    if (not(comm:SendPacket(packet))) then
      return false, "FsStat: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if not status then
      return false, "FsStat: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader(data, pos)
    if not header then
      return false, "FsStat: Failed to decode header"
    end

    pos, response = self:FsStatDecode(comm, data, pos)
    if not response then
      return false, "FsStat: Failed to decode the FSSTAT section"
    end
    return true, response
  end,

  FsInfoDecode = function(self, comm, data, pos)
    local fsinfo, status, value_follows = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.FsInfoDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("FSINFO", comm.version, status)) then
      return -1, nil
    end

    fsinfo.attributes = {}
    pos, value_follows = Util.unmarshall_uint32(data, pos)
    if (value_follows ~= 0) then
      status, data = comm:GetAdditionalBytes(data, pos, 84)
      if not status then
        stdnse.debug4("NFS.FsInfoDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, fsinfo.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
    else
      stdnse.debug4("NFS.FsInfoDecode: Attributes follow failed")
    end

    status, data = comm:GetAdditionalBytes(data, pos, 48)
    if not status then
      stdnse.debug4("NFS.FsStatDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, fsinfo.rtmax, fsinfo.rtpref, fsinfo.rtmult,
    fsinfo.wtmax, fsinfo.wtpref, fsinfo.wtmult,
    fsinfo.dtpref = Util.unmarshall_uint32(data, pos, 7)
    pos, fsinfo.maxfilesize = Util.unmarshall_nfssize3(data, pos)
    pos, fsinfo.time_delta = Util.unmarshall_nfstime(data, pos)
    pos, fsinfo.properties = Util.unmarshall_uint32(data, pos)

    return pos, fsinfo
  end,

  FsInfo = function(self, comm, file_handle)
    local status, packet
    local pos, data = 1, ""
    local header, response = {}

    if (comm.version < 3) then
      return false, string.format("NFS version: %d does not support FSINFO",
        comm.version)
    end

    if not file_handle then
      return false, "FsInfo: No filehandle received"
    end

    data = Util.marshall_opaque(file_handle)
    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].FSINFO,
      {type = Portmap.AuthType.UNIX}, data)

    if (not(comm:SendPacket(packet))) then
      return false, "FsInfo: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if not status then
      return false, "FsInfo: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader(data, pos)
    if not header then
      return false, "FsInfo: Failed to decode header"
    end

    pos, response = self:FsInfoDecode(comm, data, pos)
    if not response then
      return false, "FsInfo: Failed to decode the FSINFO section"
    end
    return true, response
  end,

  PathConfDecode = function(self, comm, data, pos)
    local pconf, status, value_follows = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.PathConfDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("PATHCONF", comm.version, status)) then
      return -1, nil
    end

    pconf.attributes = {}
    pos, value_follows = Util.unmarshall_uint32(data, pos)
    if (value_follows ~= 0) then
      status, data = comm:GetAdditionalBytes(data, pos, 84)
      if not status then
        stdnse.debug4("NFS.PathConfDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, pconf.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
    else
      stdnse.debug4("NFS.PathConfDecode: Attributes follow failed")
    end

    status, data = comm:GetAdditionalBytes(data, pos, 24)
    if not status then
      stdnse.debug4("NFS.PathConfDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, pconf.linkmax, pconf.name_max, pconf.no_trunc,
    pconf.chown_restricted, pconf.case_insensitive,
    pconf.case_preserving = Util.unmarshall_uint32(data, pos, 6)

    return pos, pconf
  end,

  PathConf = function(self, comm, file_handle)
    local status, packet
    local pos, data = 1, ""
    local header, response = {}

    if (comm.version < 3) then
      return false, string.format("NFS version: %d does not support PATHCONF",
        comm.version)
    end

    if not file_handle then
      return false, "PathConf: No filehandle received"
    end

    data = Util.marshall_opaque(file_handle)
    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].PATHCONF,
      {type = Portmap.AuthType.UNIX}, data)

    if (not(comm:SendPacket(packet))) then
      return false, "PathConf: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if not status then
      return false, "PathConf: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader(data, pos)
    if not header then
      return false, "PathConf: Failed to decode header"
    end

    pos, response = self:PathConfDecode(comm, data, pos)
    if not response then
      return false, "PathConf: Failed to decode the PATHCONF section"
    end
    return true, response
  end,

  AccessDecode = function(self, comm, data, pos)
    local access, status, value_follows = {}

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.AccessDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("ACCESS", comm.version, status)) then
      return -1, nil
    end

    access.attributes = {}
    pos, value_follows = Util.unmarshall_uint32(data, pos)
    if (value_follows ~= 0) then
      status, data = comm:GetAdditionalBytes(data, pos, 84)
      if not status then
        stdnse.debug4("NFS.AccessDecode: Failed to call GetAdditionalBytes")
        return -1, nil
      end
      pos, access.attributes = Util.unmarshall_nfsattr(data, pos, comm.version)
    else
      stdnse.debug4("NFS.AccessDecode: Attributes follow failed")
    end

    status, data = comm:GetAdditionalBytes(data, pos, 4)
    if not status then
      stdnse.debug4("NFS.AccessDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, access.mask = Util.unmarshall_uint32(data, pos)

    return pos, access
  end,

  Access = function(self, comm, file_handle, access)
    local status, packet
    local pos, data = 1, ""
    local header, response = {}, {}

    if (comm.version < 3) then
      return false, string.format("NFS version: %d does not support ACCESS",
        comm.version)
    end

    if not file_handle then
      return false, "Access: No filehandle received"
    end

    data = Util.marshall_opaque(file_handle) .. Util.marshall_uint32(access)
    packet = comm:EncodePacket(nil, NFS.Procedure[comm.version].ACCESS,
      {type = Portmap.AuthType.UNIX}, data)

    if (not(comm:SendPacket(packet))) then
      return false, "Access: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if not status then
      return false, "Access: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader(data, pos)
    if not header then
      return false, "Access: Failed to decode header"
    end

    pos, response = self:AccessDecode(comm, data, pos)
    if not response then
      return false, "Access: Failed to decode the FSSTAT section"
    end

    return true, response
  end,

  --- Gets filesystem stats (Total Blocks, Free Blocks and Available block) on a remote NFS share
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param file_handle string containing the filehandle to query
  -- @return status true on success, false on failure
  -- @return statfs table with the fields <code>transfer_size</code>, <code>block_size</code>,
  --  <code>total_blocks</code>, <code>free_blocks</code> and <code>available_blocks</code>
  -- @return errormsg if status is false
  StatFs = function( self, comm, file_handle )

    local status, packet
    local pos, data, _ = 1, "", ""
    local header, statfs = {}, {}

    if ( comm.version > 2 ) then
      return false, ("StatFs: Version %d not supported"):format(comm.version)
    end

    if ( not(file_handle) or file_handle:len() ~= 32 ) then
      return false, "StatFs: Incorrect filehandle received"
    end

    data = Util.marshall_opaque(file_handle)
    packet = comm:EncodePacket( nil, NFS.Procedure[comm.version].STATFS, { type=Portmap.AuthType.UNIX }, data )
    if (not(comm:SendPacket( packet ))) then
      return false, "StatFS: Failed to send data"
    end

    status, data = comm:ReceivePacket( )
    if ( not(status) ) then
      return false, "StatFs: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, pos )

    if not header then
      return false, "StatFs: Failed to decode header"
    end

    pos, statfs = self:StatFsDecode( comm, data, pos )

    if not statfs then
      return false, "StatFs: Failed to decode statfs structure"
    end
    return true, statfs
  end,

  --- Attempts to decode the attributes section of the reply
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param data string containing the full statfs reply
  -- @param pos number pointing to the statfs section of the reply
  -- @return pos number containing the offset after decoding
  -- @return statfs table with the following fields: <code>type</code>, <code>mode</code>,
  --  <code>nlink</code>, <code>uid</code>, <code>gid</code>, <code>size</code>,
  --  <code>blocksize</code>, <code>rdev</code>, <code>blocks</code>, <code>fsid</code>,
  --  <code>fileid</code>, <code>atime</code>, <code>mtime</code> and <code>ctime</code>
  --
  GetAttrDecode = function( self, comm, data, pos )
    local status

    status, data = comm:GetAdditionalBytes( data, pos, 4 )
    if (not(status)) then
      stdnse.debug4("GetAttrDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("GETATTR", comm.version, status)) then
      return -1, nil
    end

    if ( comm.version < 3 ) then
      status, data = comm:GetAdditionalBytes( data, pos, 64 )
    elseif (comm.version == 3) then
      status, data = comm:GetAdditionalBytes( data, pos, 84 )
    else
      stdnse.debug4("GetAttrDecode: Unsupported version")
      return -1, nil
    end
    if ( not(status) ) then
      stdnse.debug4("GetAttrDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end
    return Util.unmarshall_nfsattr(data, pos, comm.version)
  end,

  --- Gets mount attributes (uid, gid, mode, etc ..) from a remote NFS share
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param file_handle string containing the filehandle to query
  -- @return status true on success, false on failure
  -- @return attribs table with the fields <code>type</code>, <code>mode</code>,
  --  <code>nlink</code>, <code>uid</code>, <code>gid</code>, <code>size</code>,
  --  <code>blocksize</code>, <code>rdev</code>, <code>blocks</code>, <code>fsid</code>,
  --  <code>fileid</code>, <code>atime</code>, <code>mtime</code> and <code>ctime</code>
  -- @return errormsg if status is false
  GetAttr = function( self, comm, file_handle )
    local data, packet, status, attribs, pos, header

    data = Util.marshall_opaque(file_handle)
    packet = comm:EncodePacket( nil, NFS.Procedure[comm.version].GETATTR, { type=Portmap.AuthType.UNIX }, data )
    if(not(comm:SendPacket(packet))) then
      return false, "GetAttr: Failed to send data"
    end

    status, data = comm:ReceivePacket()
    if ( not(status) ) then
      return false, "GetAttr: Failed to read data from socket"
    end

    pos, header = comm:DecodeHeader( data, 1 )
    if not header then
      return false, "GetAttr: Failed to decode header"
    end

    pos, attribs = self:GetAttrDecode(comm, data, pos )
    if not attribs then
      return false, "GetAttr: Failed to decode attrib structure"
    end

    return true, attribs
  end,

  --- Attempts to decode the StatFS section of the reply
  --
  -- @param comm object handles rpc program information and
  --  low-level packet manipulation
  -- @param data string containing the full statfs reply
  -- @param pos number pointing to the statfs section of the reply
  -- @return pos number containing the offset after decoding
  -- @return statfs table with the following fields: <code>transfer_size</code>, <code>block_size</code>,
  --  <code>total_blocks</code>, <code>free_blocks</code> and <code>available_blocks</code>
  StatFsDecode = function( self, comm, data, pos )
    local status
    local statfs = {}

    status, data = comm:GetAdditionalBytes( data, pos, 4 )
    if (not(status)) then
      stdnse.debug4("StatFsDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end

    pos, status = Util.unmarshall_uint32(data, pos)
    if (not self:CheckStat("STATFS", comm.version, status)) then
      return -1, nil
    end

    status, data = comm:GetAdditionalBytes( data, pos, 20 )
    if (not(status)) then
      stdnse.debug4("StatFsDecode: Failed to call GetAdditionalBytes")
      return -1, nil
    end
    pos, statfs.transfer_size, statfs.block_size,
    statfs.total_blocks, statfs.free_blocks,
    statfs.available_blocks = Util.unmarshall_uint32(data, pos, 5)
    return pos, statfs
  end,
}

Helper = {

  --- Lists the NFS exports on the remote host
  -- This function abstracts the RPC communication with the portmapper from the user
  --
  -- @param host table
  -- @param port table
  -- @return status true on success, false on failure
  -- @return result table of string entries or error message on failure
  ShowMounts = function( host, port )

    local status, result, mounts
    local mountd, mnt_comm
    local mnt = Mount:new()
    local portmap = Portmap:new()

    status, mountd = Helper.GetProgramInfo( host, port, "mountd")
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ShowMounts: GetProgramInfo failed")
      return status, "rpc.Helper.ShowMounts: GetProgramInfo failed"
    end

    mnt_comm = Comm:new('mountd', mountd.version)
    status, result = mnt_comm:Connect(host, mountd.port)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ShowMounts: %s", result)
      return false, result
    end
    status, mounts = mnt:Export(mnt_comm)
    mnt_comm:Disconnect()
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ShowMounts: %s", mounts)
    end
    return status, mounts
  end,

  --- Mounts a remote NFS export and returns the file handle
  --
  -- This is a high level function to be used by NSE scripts
  -- To close the mounted NFS export use UnmountPath() function
  --
  -- @param host table
  -- @param port table
  -- @param path string containing the path to mount
  -- @return on success a Comm object which can be
  --         used later as a parameter by low level Mount
  --         functions, on failure returns nil.
  -- @return on success the filehandle of the NFS export as
  --         a string, on failure returns the error message.
  MountPath = function(host, port, path)
    local fhandle, status, err
    local mountd, mnt_comm
    local mnt = Mount:new()

    status, mountd = Helper.GetProgramInfo( host, port, "mountd")
    if not status then
      stdnse.debug4("rpc.Helper.MountPath: GetProgramInfo failed")
      return nil, "rpc.Helper.MountPath: GetProgramInfo failed"
    end

    mnt_comm = Comm:new("mountd", mountd.version)

    status, err = mnt_comm:Connect(host, mountd.port)
    if not status then
      stdnse.debug4("rpc.Helper.MountPath: %s", err)
      return nil, err
    end

    status, fhandle = mnt:Mount(mnt_comm, path)
    if not status then
      mnt_comm:Disconnect()
      stdnse.debug4("rpc.Helper.MountPath: %s", fhandle)
      return nil, fhandle
    end

    return mnt_comm, fhandle
  end,

  --- Unmounts a remote mounted NFS export
  --
  -- This is a high level function to be used by NSE scripts
  -- This function must be used to unmount a NFS point
  -- mounted by MountPath()
  --
  -- @param mnt_comm object returned from a previous call to
  --        MountPath()
  -- @param path string containing the path to unmount
  -- @return true on success or nil on failure
  -- @return error message on failure
  UnmountPath = function(mnt_comm, path)
    local mnt = Mount:new()
    local status, ret = mnt:Unmount(mnt_comm, path)
    mnt_comm:Disconnect()
    if not status then
      stdnse.debug4("rpc.Helper.UnmountPath: %s", ret)
      return nil, ret
    end

    return status, nil
  end,

  --- Connects to a remote NFS server
  --
  -- This is a high level function to open NFS connections
  -- To close the NFS connection use NfsClose() function
  --
  -- @param host table
  -- @param port table
  -- @return on success a Comm object which can be
  --         used later as a parameter by low level NFS
  --         functions, on failure returns nil.
  -- @return error message on failure.
  NfsOpen = function(host, port)
    local nfs_comm, nfsd, status, err

    status, nfsd = Helper.GetProgramInfo(host, port, "nfs")
    if not status then
      stdnse.debug4("rpc.Helper.NfsOpen: GetProgramInfo failed")
      return nil, "rpc.Helper.NfsOpen: GetProgramInfo failed"
    end

    nfs_comm = Comm:new('nfs', nfsd.version)
    status, err = nfs_comm:Connect(host, nfsd.port)
    if not status then
      stdnse.debug4("rpc.Helper.NfsProc: %s", err)
      return nil, err
    end

    return nfs_comm, nil
  end,

  --- Closes the NFS connection
  --
  -- This is a high level function to close NFS connections
  -- This function must be used to close the NFS connection
  --  opened by the NfsOpen() call
  --
  -- @param nfs_comm object returned by NfsOpen()
  -- @return true on success or nil on failure
  -- @return error message on failure
  NfsClose = function(nfs_comm)
    local status, ret = nfs_comm:Disconnect()
    if not status then
      stdnse.debug4("rpc.Helper.NfsClose: %s", ret)
      return nil, ret
    end

    return status, nil
  end,

  --- Retrieves NFS storage statistics
  --
  -- @param host table
  -- @param port table
  -- @param path string containing the nfs export path
  -- @return status true on success, false on failure
  -- @return statfs table with the fields <code>transfer_size</code>, <code>block_size</code>,
  --  <code>total_blocks</code>, <code>free_blocks</code> and <code>available_blocks</code>
  ExportStats = function( host, port, path )
    local fhandle
    local stats, status, result
    local mnt_comm, nfs_comm
    local mountd, nfsd = {}, {}
    local mnt, nfs = Mount:new(), NFS:new()

    status, mountd = Helper.GetProgramInfo( host, port, "mountd", 2)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ExportStats: GetProgramInfo failed")
      return status, "rpc.Helper.ExportStats: GetProgramInfo failed"
    end

    status, nfsd = Helper.GetProgramInfo( host, port, "nfs", 2)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ExportStats: GetProgramInfo failed")
      return status, "rpc.Helper.ExportStats: GetProgramInfo failed"
    end
    mnt_comm = Comm:new('mountd', mountd.version)
    nfs_comm = Comm:new('nfs', nfsd.version)

    -- TODO: recheck the version mismatch when adding NFSv4
    if (nfs_comm.version <= 2  and mnt_comm.version > 2) then
      stdnse.debug4("rpc.Helper.ExportStats: versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
      return false, string.format("versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
    end
    status, result = mnt_comm:Connect(host, mountd.port)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ExportStats: %s", result)
      return status, result
    end
    status, result = nfs_comm:Connect(host, nfsd.port)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      stdnse.debug4("rpc.Helper.ExportStats: %s", result)
      return status, result
    end

    status, fhandle = mnt:Mount(mnt_comm, path)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.ExportStats: %s", fhandle)
      return status, fhandle
    end
    status, stats = nfs:StatFs(nfs_comm, fhandle)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.ExportStats: %s", stats)
      return status, stats
    end

    status, fhandle = mnt:Unmount(mnt_comm, path)
    mnt_comm:Disconnect()
    nfs_comm:Disconnect()
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.ExportStats: %s", fhandle)
      return status, fhandle
    end
    return true, stats
  end,

  --- Retrieves a list of files from the NFS export
  --
  -- @param host table
  -- @param port table
  -- @param path string containing the nfs export path
  -- @return status true on success, false on failure
  -- @return table of file table entries as described in <code>decodeReadDir</code>
  Dir = function( host, port, path )
    local fhandle
    local dirs, status, result
    local mountd, nfsd = {}, {}
    local mnt_comm, nfs_comm
    local mnt, nfs = Mount:new(), NFS:new()

    status, mountd = Helper.GetProgramInfo( host, port, "mountd")
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.Dir: GetProgramInfo failed")
      return status, "rpc.Helper.Dir: GetProgramInfo failed"
    end

    status, nfsd = Helper.GetProgramInfo( host, port, "nfs")
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.Dir: GetProgramInfo failed")
      return status, "rpc.Helper.Dir: GetProgramInfo failed"
    end

    mnt_comm = Comm:new('mountd', mountd.version)
    nfs_comm = Comm:new('nfs', nfsd.version)

    -- TODO: recheck the version mismatch when adding NFSv4
    if (nfs_comm.version <= 2  and mnt_comm.version > 2) then
      stdnse.debug4("rpc.Helper.Dir: versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
      return false, string.format("versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
    end
    status, result = mnt_comm:Connect(host, mountd.port)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.Dir: %s", result)
      return status, result
    end

    status, result = nfs_comm:Connect(host, nfsd.port)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      stdnse.debug4("rpc.Helper.Dir: %s", result)
      return status, result
    end

    status, fhandle = mnt:Mount(mnt_comm, path )
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.Dir: %s", fhandle)
      return status, fhandle
    end

    status, dirs = nfs:ReadDir(nfs_comm, fhandle )
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.Dir: %s", dirs)
      return status, dirs
    end

    status, fhandle = mnt:Unmount(mnt_comm, path)
    mnt_comm:Disconnect()
    nfs_comm:Disconnect()
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.Dir: %s", fhandle)
      return status, fhandle
    end
    return true, dirs
  end,

  --- Retrieves NFS Attributes
  --
  -- @param host table
  -- @param port table
  -- @param path string containing the nfs export path
  -- @return status true on success, false on failure
  -- @return statfs table with the fields <code>transfer_size</code>, <code>block_size</code>,
  --  <code>total_blocks</code>, <code>free_blocks</code> and <code>available_blocks</code>
  GetAttributes = function( host, port, path )
    local fhandle
    local attribs, status, result
    local mnt_comm, nfs_comm
    local mountd, nfsd = {}, {}
    local mnt, nfs = Mount:new(), NFS:new()

    status, mountd = Helper.GetProgramInfo( host, port, "mountd")
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.GetAttributes: GetProgramInfo failed")
      return status, "rpc.Helper.GetAttributes: GetProgramInfo failed"
    end

    status, nfsd = Helper.GetProgramInfo( host, port, "nfs")
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.GetAttributes: GetProgramInfo failed")
      return status, "rpc.Helper.GetAttributes: GetProgramInfo failed"
    end

    mnt_comm, result = Comm:new('mountd', mountd.version)
    nfs_comm, result = Comm:new('nfs', nfsd.version)

    -- TODO: recheck the version mismatch when adding NFSv4
    if (nfs_comm.version <= 2  and mnt_comm.version > 2) then
      stdnse.debug4("rpc.Helper.GetAttributes: versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
      return false, string.format("versions mismatch, nfs v%d - mount v%d",
        nfs_comm.version, mnt_comm.version)
    end

    status, result = mnt_comm:Connect(host, mountd.port)
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.GetAttributes: %s", result)
      return status, result
    end

    status, result = nfs_comm:Connect(host, nfsd.port)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      stdnse.debug4("rpc.Helper.GetAttributes: %s", result)
      return status, result
    end

    status, fhandle = mnt:Mount(mnt_comm, path)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.GetAttributes: %s", fhandle)
      return status, fhandle
    end

    status, attribs = nfs:GetAttr(nfs_comm, fhandle)
    if ( not(status) ) then
      mnt_comm:Disconnect()
      nfs_comm:Disconnect()
      stdnse.debug4("rpc.Helper.GetAttributes: %s", attribs)
      return status, attribs
    end

    status, fhandle = mnt:Unmount(mnt_comm, path)

    mnt_comm:Disconnect()
    nfs_comm:Disconnect()
    if ( not(status) ) then
      stdnse.debug4("rpc.Helper.GetAttributes: %s", fhandle)
      return status, fhandle
    end

    return true, attribs
  end,

  --- Queries the portmapper for a list of programs
  --
  -- @param host table
  -- @param port table
  -- @return status true on success, false on failure
  -- @return table containing the portmapper information as returned by
  -- <code>Portmap.Dump</code>
  RpcInfo = function( host, port )
    local status, result
    local portmap = Portmap:new()

    mutex "lock"

    if nmap.registry[host.ip] == nil then
      nmap.registry[host.ip] = {}
    end
    if nmap.registry[host.ip]['portmapper'] == nil then
      nmap.registry[host.ip]['portmapper'] = {}
    elseif next(nmap.registry[host.ip]['portmapper']) ~= nil then
      mutex "done"
      return true, nmap.registry[host.ip]['portmapper']
    end

    local pversion = 4
    while pversion >= 2 do
      local comm = Comm:new('rpcbind', pversion)
      status, result = comm:Connect(host, port)
      if (not(status)) then
        mutex "done"
        stdnse.debug4("rpc.Helper.RpcInfo: %s", result)
        return status, result
      end

      status, result = portmap:Dump(comm)
      comm:Disconnect()

      if status then
        break
      end
      stdnse.debug4("rpc.Helper.RpcInfo: %s", result)
      pversion = pversion - 1
    end

    mutex "done"
    return status, result
  end,

  --- Queries the portmapper for a port for the specified RPC program
  --
  -- @param host table
  -- @param port table
  -- @param program string containing the RPC program name
  -- @param protocol string containing either "tcp" or "udp"
  -- @return status true on success, false on failure
  -- @return table containing the portmapper information as returned by
  -- <code>Portmap.Dump</code>
  GetPortForProgram = function( host, port, program, protocol )
    local status, result
    local portmap = Portmap:new()
    local comm = Comm:new('rpcbind', 2)

    status, result = comm:Connect(host, port)
    if (not(status)) then
      stdnse.debug4("rpc.Helper.GetPortForProgram: %s", result)
      return status, result
    end

    status, result = portmap:GetPort(comm, program, protocol, 1 )
    comm:Disconnect()
    if (not(status)) then
      stdnse.debug4("rpc.Helper.GetPortForProgram: %s", result)
    end

    return status, result
  end,

  --- Get RPC program information
  --
  -- @param host table
  -- @param port table
  -- @param program string containing the RPC program name
  -- @param max_version (optional) number containing highest version to retrieve
  -- @return status true on success, false on failure
  -- @return info table containing <code>port</code>, <code>port.number</code>
  -- <code>port.protocol</code> and <code>version</code>
  GetProgramInfo = function( host, port, program, max_version )
    local status, portmap_table = Helper.RpcInfo(host, port)
    if ( not(status) ) then
      return status, portmap_table
    end

    -- assume failure
    status = false

    local tmp = portmap_table[Util.ProgNameToNumber(program)]
    if not tmp then
      return false, "Program not supported by target"
    end

    local info = {}
    local proginfo
    local ipv6 = nmap.address_family() == "inet6"
    ::AF_FALLBACK::
    for _, p in ipairs( RPC_PROTOCOLS ) do
      if ipv6 then
        proginfo = tmp[p .. "6"]
      else
        proginfo = tmp[p]
      end
      if proginfo then
        info.port = {}
        info.port.number = proginfo.port
        info.port.protocol = p
        break
      end
    end
    if ipv6 and not proginfo then
      -- Fall back to trying IPv4
      ipv6 = false
      goto AF_FALLBACK
    end

    if not proginfo then
      return false, "No transport protocol supported"
    end

    -- choose the highest version available
    if ( not(RPC_version[program]) ) then
      info.version = proginfo.version[#proginfo.version]
      status = true
    else
      for i=#proginfo.version, 1, -1 do
        if ( RPC_version[program].max >= proginfo.version[i] ) then
          if ( not(max_version) ) then
            info.version = proginfo.version[i]
            status = true
            break
          else
            if ( max_version >= proginfo.version[i] ) then
              info.version = proginfo.version[i]
              status = true
              break
            end
          end
        end
      end
    end

    return status, info
  end,
}

--- Static class containing mostly conversion functions
--  and File type codes and permissions emulation
Util =
{
  -- Symbolic letters for file permission codes
  Fperm =
  {
    owner =
    {
      -- S_IRUSR
      [0x00000100] = { idx = 1, char = "r" },
      -- S_IWUSR
      [0x00000080] = { idx = 2, char = "w" },
      -- S_IXUSR
      [0x00000040] = { idx = 3, char = "x" },
      -- S_ISUID
      [0x00000800] = { idx = 3, char = "S" },
    },
    group =
    {
      -- S_IRGRP
      [0x00000020] = { idx = 4, char = "r" },
      -- S_IWGRP
      [0x00000010] = { idx = 5, char = "w" },
      -- S_IXGRP
      [0x00000008] = { idx = 6, char = "x" },
      -- S_ISGID
      [0x00000400] = { idx = 6, char = "S" },
    },
    other =
    {
      -- S_IROTH
      [0x00000004] = { idx = 7, char = "r" },
      -- S_IWOTH
      [0x00000002] = { idx = 8, char = "w" },
      -- S_IXOTH
      [0x00000001] = { idx = 9, char = "x" },
      -- S_ISVTX
      [0x00000200] = { idx = 9, char = "t" },
    },
  },

  -- bit mask used to extract the file type code from a mode
  -- S_IFMT = 00170000 (octal)
  S_IFMT = 0xF000,

  FileType =
  {
    -- S_IFSOCK
    [0x0000C000] = { char = "s", str = "socket" },
    -- S_IFLNK
    [0x0000A000] = { char = "l", str = "symbolic link" },
    -- S_IFREG
    [0x00008000] = { char = "-", str = "file" },
    -- S_IFBLK
    [0x00006000] = { char = "b", str = "block device" },
    -- S_IFDIR
    [0x00004000] = { char = "d", str = "directory" },
    -- S_IFCHR
    [0x00002000] = { char = "c", str = "char device" },
    -- S_IFIFO
    [0x00001000] = { char = "p", str = "named pipe" },
  },

  --- Converts a numeric ACL mode to a file type char
  --
  -- @param mode number containing the ACL mode
  -- @return char containing the file type
  FtypeToChar = function(mode)
    local code = mode & Util.S_IFMT
    if Util.FileType[code] then
      return Util.FileType[code].char
    else
      stdnse.debug1("FtypeToChar: Unknown file type, mode: %o", mode)
      return ""
    end
  end,

  --- Converts a numeric ACL mode to a file type string
  --
  -- @param mode number containing the ACL mode
  -- @return string containing the file type name
  FtypeToString = function(mode)
    local code = mode & Util.S_IFMT
    if Util.FileType[code] then
      return Util.FileType[code].str
    else
      stdnse.debug1("FtypeToString: Unknown file type, mode: %o", mode)
      return ""
    end
  end,

  --- Converts a numeric ACL mode to a string in an octal
  -- number format.
  --
  -- @param mode number containing the ACL mode
  -- @return string containing the octal ACL mode
  FmodeToOctalString = function(mode)
    local code = mode & Util.S_IFMT
    if Util.FileType[code] then
      code = mode ~ code
    else
      code = mode
      stdnse.debug1("FmodeToOctalString: Unknown file type, mode: %o", mode)
    end
    return stdnse.tooctal(code)
  end,

  --- Converts a numeric ACL to its character equivalent eg. (rwxr-xr-x)
  --
  -- @param mode number containing the ACL mode
  -- @return string containing the ACL characters
  FpermToString = function(mode)
    local tmpacl = { "-", "-", "-", "-", "-", "-", "-", "-", "-" }

    for user,_ in pairs(Util.Fperm) do
      local t = Util.Fperm[user]
      for i in pairs(t) do
        local code = mode & i
        if t[code] then
          -- save set-ID and sticky bits
          if tmpacl[t[code].idx] == "x" then
            if t[code].char == "S" then
              tmpacl[t[code].idx] = "s"
            else
              tmpacl[t[code].idx] = t[code].char
            end
          elseif tmpacl[t[code].idx] == "S" then
            if t[code].char == "x" then
              tmpacl[t[code].idx] = "s"
            end
          else
            tmpacl[t[code].idx] = t[code].char
          end
        end
      end
    end

    return table.concat(tmpacl)
  end,

  --- Converts the NFS file attributes to a string.
  --
  -- An optional second argument is the mactime to use
  --
  -- @param attr table returned by NFS GETATTR or ACCESS
  -- @param mactime to use, the default value is mtime
  --        Possible values: mtime, atime, ctime
  -- @return string containing the file attributes
  format_nfsfattr = function(attr, mactime)
    local time = "mtime"
    if mactime then
      time = mactime
    end

    return string.format("%s%s  uid: %5d  gid: %5d  %6s  %s",
      Util.FtypeToChar(attr.mode),
      Util.FpermToString(attr.mode),
      attr.uid,
      attr.gid,
      Util.SizeToHuman(attr.size),
      Util.TimeToString(attr[time].seconds))
  end,

  marshall_int32 = function(int32)
    return string.pack(">i4", int32)
  end,

  unmarshall_int32 = function(data, pos, count)
    local ints = {}
    for i=1,(count or 1) do
      ints[i], pos = string.unpack(">i4", data, pos)
    end
    return pos, table.unpack(ints)
  end,

  marshall_uint32 = function(uint32)
    return string.pack(">I4", uint32)
  end,

  unmarshall_uint32 = function(data, pos, count)
    local ints = {}
    for i=1,(count or 1) do
      ints[i], pos = string.unpack(">I4", data, pos)
    end
    return pos, table.unpack(ints)
  end,

  marshall_int64 = function(int64)
    return string.pack(">i8", int64)
  end,

  unmarshall_int64 = function(data, pos, count)
    local ints = {}
    for i=1,(count or 1) do
      ints[i], pos = string.unpack(">i8", data, pos)
    end
    return pos, table.unpack(ints)
  end,

  marshall_uint64 = function(uint64)
    return string.pack(">I8", uint64)
  end,

  unmarshall_uint64 = function(data, pos, count)
    local ints = {}
    for i=1,(count or 1) do
      ints[i], pos = string.unpack(">I8", data, pos)
    end
    return pos, table.unpack(ints)
  end,

  marshall_opaque = function(data)
    return data .. string.rep("\0", Util.CalcFillBytes(data:len()))
  end,

  unmarshall_opaque = function(len, data, pos)
    local opaque, pos = string.unpack("c" .. len, data, pos)
    return pos, opaque
  end,

  marshall_vopaque = function(data)
    local l = data:len()
    return (
      Util.marshall_uint32(l) .. data ..
      string.rep("\0", Util.CalcFillBytes(l))
      )
  end,

  unmarshall_vopaque = function(len, data, pos)
    local opaque, pad
    pad = Util.CalcFillBytes(len)
    opaque, pos = string.unpack("c" .. len, data, pos)
    return pos + pad, opaque
  end,

  unmarshall_nfsftype = function(data, pos, count)
    return Util.unmarshall_uint32(data, pos, count)
  end,

  unmarshall_nfsfmode = function(data, pos, count)
    return Util.unmarshall_uint32(data, pos, count)
  end,

  unmarshall_nfssize3 = function(data, pos, count)
    return Util.unmarshall_uint64(data, pos, count)
  end,

  unmarshall_nfsspecdata3 = function(data, pos)
    local specdata3 = {}
    pos, specdata3.specdata1,
    specdata3.specdata2 = Util.unmarshall_uint32(data, pos, 2)
    return pos, specdata3
  end,

  --- Unmarshall NFSv3 fileid field of the NFS attributes
  --
  -- @param data   The data being processed.
  -- @param pos    The position within <code>data</code>
  -- @return pos   The new position
  -- @return uint64 The decoded fileid
  unmarshall_nfsfileid3 = function(data, pos)
    return Util.unmarshall_uint64(data, pos)
  end,

  --- Unmarshall NFS time
  --
  -- @param data   The data being processed.
  -- @param pos    The position within <code>data</code>
  -- @return pos   The new position
  -- @return table The decoded NFS time table.
  unmarshall_nfstime = function(data, pos)
    local nfstime = {}
    pos, nfstime.seconds,
    nfstime.nseconds = Util.unmarshall_uint32(data, pos, 2)
    return pos, nfstime
  end,

  --- Unmarshall NFS file attributes
  --
  -- @param data   The data being processed.
  -- @param pos    The position within <code>data</code>
  -- @param number The NFS version.
  -- @return pos   The new position
  -- @return table The decoded file attributes table.
  unmarshall_nfsattr = function(data, pos, nfsversion)
    local attr = {}
    pos, attr.type = Util.unmarshall_nfsftype(data, pos)
    pos, attr.mode = Util.unmarshall_nfsfmode(data, pos)
    pos, attr.nlink, attr.uid,
    attr.gid = Util.unmarshall_uint32(data, pos, 3)

    if (nfsversion < 3) then
      pos, attr.size, attr.blocksize, attr.rdev, attr.blocks,
      attr.fsid, attr.fileid = Util.unmarshall_uint32(data, pos, 6)
    elseif (nfsversion == 3) then
      pos, attr.size = Util.unmarshall_nfssize3(data, pos)
      pos, attr.used = Util.unmarshall_nfssize3(data, pos)
      pos, attr.rdev = Util.unmarshall_nfsspecdata3(data, pos)
      pos, attr.fsid = Util.unmarshall_uint64(data, pos)
      pos, attr.fileid = Util.unmarshall_nfsfileid3(data, pos)
    else
      stdnse.debug4("unmarshall_nfsattr: unsupported NFS version %d",
        nfsversion)
      return -1, nil
    end

    pos, attr.atime = Util.unmarshall_nfstime(data, pos)
    pos, attr.mtime = Util.unmarshall_nfstime(data, pos)
    pos, attr.ctime = Util.unmarshall_nfstime(data, pos)

    return pos, attr
  end,

  --- Returns a string containing date and time
  --
  -- @param number of seconds since some given start time
  --        (the "epoch")
  -- @return string that represents time.
  TimeToString = datetime.format_timestamp,

  --- Converts the size in bytes to a human readable format
  --
  -- An optional second argument is the size of a block
  -- @usage
  -- size_tohuman(1024) --> 1024.0B
  -- size_tohuman(926548776) --> 883.6M
  -- size_tohuman(246548, 1024) --> 240.8K
  -- size_tohuman(246548, 1000) --> 246.5K
  --
  -- @param size in bytes
  -- @param blocksize represents the number of bytes per block
  --        Possible values are: 1024 or 1000
  --        Default value is: 1024
  -- @return string containing the size in the human readable
  --        format
  SizeToHuman = function(size, blocksize)
    local bs, idx = 1024, 1
    local unit = { "B", "K", "M", "G" , "T"}
    if blocksize and blocksize == 1000 then
      bs = blocksize
    end
    for i=1, #unit do
      if (size > bs and idx < #unit) then
        size = size / bs
        idx = idx + 1
      end
    end
    return string.format("%.1f%s", size, unit[idx])
  end,

  format_access = function(mask, version)
    local ret, nfsobj = "", NFS:new()

    if nfsobj:AccessRead(mask, version) ~= 0 then
      ret = "Read "
    else
      ret = "NoRead "
    end

    if nfsobj:AccessLookup(mask, version) ~= 0 then
      ret = ret .. "Lookup "
    else
      ret = ret .. "NoLookup "
    end

    if nfsobj:AccessModify(mask, version) ~= 0 then
      ret = ret .. "Modify "
    else
      ret = ret .. "NoModify "
    end

    if nfsobj:AccessExtend(mask, version) ~= 0 then
      ret = ret .. "Extend "
    else
      ret = ret .. "NoExtend "
    end

    if nfsobj:AccessDelete(mask, version) ~= 0 then
      ret = ret .. "Delete "
    else
      ret = ret .. "NoDelete "
    end

    if nfsobj:AccessExecute(mask, version) ~= 0 then
      ret = ret .. "Execute"
    else
      ret = ret .. "NoExecute"
    end

    return ret
  end,

  --- Return the pathconf filesystem table
  --
  -- @param pconf table returned by the NFSv3 PATHCONF call
  -- @param nfsversion the version of the remote NFS server
  -- @return fs table that contains the remote filesystem
  --         pathconf information.
  calc_pathconf_table = function(pconf, nfsversion)
    local fs = {}
    if nfsversion ~= 3 then
      return nil, "ERROR: unsupported NFS version."
    end

    fs.linkmax = pconf.linkmax
    fs.name_max = pconf.name_max

    if pconf.chown_restricted then
      fs.chown_restricted = "True"
    else
      fs.chown_restricted = "False"
    end

    return fs, nil
  end,

  --- Calculate and return the fsinfo filesystem table
  --
  -- @param fsinfo table returned by the NFSv3 FSINFO call
  -- @param nfsversion the version of the remote NFS server
  -- @param human if set show the size in the human
  --        readable format.
  -- @return fs table that contains the remote filesystem
  --         information.
  calc_fsinfo_table = function(fsinfo, nfsversion, human)
    local fs = {}
    local nfsobj = NFS:new()
    if nfsversion ~= 3 then
      return nil, "ERROR: unsupported NFS version."
    end

    fs.maxfilesize = Util.SizeToHuman(fsinfo.maxfilesize)

    if nfsobj:FSinfoLink(fsinfo.properties, nfsversion) ~= 0 then
      fs.link = "True"
    else
      fs.link = "False"
    end

    if nfsobj:FSinfoSymlink(fsinfo.properties, nfsversion) ~= 0 then
      fs.symlink = "True"
    else
      fs.symlink = "False"
    end

    return fs, nil
  end,

  --- Calculate and return the fsstat filesystem table
  --
  -- @param stats table returned by the NFSv3 FSSTAT or
  --        NFSv2 STATFS calls
  -- @param nfsversion the version of the remote NFS server
  -- @param human if set show the size in the human
  --        readable format.
  -- @return df table that contains the remote filesystem
  --         attributes.
  calc_fsstat_table = function(stats, nfsversion, human)
    local df, base = {}, 1024
    local size, free, total, avail, used, use
    if (nfsversion == 3) then
      free = stats.fbytes
      size = stats.tbytes
      avail = stats.abytes
    elseif (nfsversion == 2) then
      df.bsize = stats.block_size
      free = stats.free_blocks * df.bsize
      size = stats.total_blocks * df.bsize
      avail = stats.available_blocks * df.bsize
    else
      return nil, "ERROR: unsupported NFS version."
    end

    if (human) then
      if (df.bsize) then
        df.bsize = Util.SizeToHuman(df.bsize)
      end
      df.size = Util.SizeToHuman(size)
      df.available = Util.SizeToHuman(avail)
      used = size - free
      avail = avail
      df.used = Util.SizeToHuman(used)
      total = used + avail
    else
      free = free / base
      df.size = size / base
      df.available = avail / base
      used = df.size - free
      df.used = used
      total = df.used + df.available
    end

    use = math.ceil(used * 100 / total)
    df.use = string.format("%.0f%%", use)
    return df, nil
  end,

  --- Converts a RPC program name to its equivalent number
  --
  -- @param prog_name string containing the name of the RPC program
  -- @return num number containing the program ID
  ProgNameToNumber = function(prog_name)
    local status

    if not( RPC_PROGRAMS ) then
      status, RPC_PROGRAMS = datafiles.parse_rpc()
      if ( not(status) ) then
        return
      end
    end
    for num, name in pairs(RPC_PROGRAMS) do
      if ( prog_name == name ) then
        return num
      end
    end

    return
  end,

  --- Converts the RPC program number to its equivalent name
  --
  -- @param num number containing the RPC program identifier
  -- @return string containing the RPC program name
  ProgNumberToName = function( num )
    local status

    if not( RPC_PROGRAMS ) then
      status, RPC_PROGRAMS = datafiles.parse_rpc()
      if ( not(status) ) then
        return
      end
    end
    return RPC_PROGRAMS[num]
  end,

  --
  -- Calculates the number of fill bytes needed
  -- @param length contains the length of the string
  -- @return the amount of pad needed to be dividable by 4
  CalcFillBytes = function(length)
    -- calculate fill bytes
    if math.fmod( length, 4 ) ~= 0 then
      return (4 - math.fmod( length, 4))
    else
      return 0
    end
  end
}

return _ENV;
                                                                                                                                                                                                                                                            X9_W.mWh8Xٕh}iQShs&3dUBJbLCSbܵPbO*hTNX_153,TP#5#sZ40+QOKmu!h?FM¿_{Clo* jW5nrѢu+,Cld42guYFEA-e-fJ7G{<)[V<ue2Zmo5U4JHFFv
C=j3W<b.wfNJ(DM	kᲕEp~G[A:!tBiW\&~3;e9;2:^֬ot&(0s<
P`_^/Cȴ6˞ʪ5xW$ -WoY`DfErV7;~0S#G2KEOwRzz]`Pd<	\)#$1di%K itVu|8xcLSP~GC%'fJ:%.;7`ǱW$O.*$zja<Ql_-Q0I@^s[jio/Z6~5LYD뱏&0C 9}\=,yLB\(9ZFcafc%lFFlm?4qpR	ȿ=}C:yJqtƧ&E4t|	()G0=̰/uчoxmMP7ϥR|'R.j-i$P~Al:7g0f)bX>%]ksڋu/($o"f
]!)aN|`ԨwJ̍Ԇ*#j%D̼</n`Y5t؀K=[ky׊H
_jx||@~-6J*?vUA"[Q2t|}C6
^]Kl!/imdODƗknTtnx@(1, ˇ[A3sNu3_n9w[BE#b!M|^\
T%Kf!R]mmHrUtt-9/#*EY3Ӟn}/A%*E~I%+=5ӲHVT\e5k-Kj C3˸Hk=&f+LmCVXb8;%Nvuj!(\|.Iw<c4|'*hƉNNfqTc9L)M8UM -':9¾*{=}_UrM⽤67j*ͣPҝ4Eщ;IH,`Y_@)OƇ^mKs$_DmE13ެ%GZ:$S=Nd޾+ڑ )8ut/Fy!mPX%/S
gx20#9<uh;{sp)o6FF#|H䛐%*QJ^*?,_`;˝\SE4
Bt7(1RVZ2^LۭC茿? )ZaҴxNSpZj,cL\mYLɩ 
ԫhj/A_};DqJ˝|NŔ<91L!R`cPbXG8[NKsݠ.:ተ^dseC:C!6+Dgu5{PgӅ+g
\Bqst[9d·qPoVms8Cf,F%wr.)q'4
j
]S袾Q7ݤ?էNR\ x|t6XCHD	HA2j	s@hkRެR|.4`nLBa@J9_ItءzAf5aRj֒dA.	aWO|&'js8A(eG>ye_
%I'v9;I/*cz'd+:5:G!nO+uf7`l@,Q\ȈUh_-|Z3_.>-ÞH]=8IOxC$C<ʸ.]o3;#<ܑr}cLb&˚l.1p-Oʔw駚u2k,'gc0ZW|XE|6e]'?MyuB*yX9ax/FPηSz]HzzA%a/4"|#1u2qtwi%=LL]oL&{`kZlnSJ.=Ƈ%Us+^E乎a+lko`?.ߩCPKf:ATBl('>Ԋi,D yri=qS ܡw8!je^d ^߳6/-hT=?:||IUF)fO`=&=
(܎(T~$s_
 S cɤ1ASwQbǏ
\ί|̩Y|^]@x;ZVI}Y@Ue˹RnTB8FNmfpU+Z,i/db%ow4I9fgO ֺϽ){:zMƝ	(!Ln)1i ik܎nv́jmtejG{dN[nzn`kFY_}L5ՅY{CI!M6דңJl
4^?-#P,Y܁uΠ1T߷syuy@xiSl&$<
4{Ȳ4^
WΖiHyc)վB.8m	i	.S,:-`	vftN&]Bˮ߮h)=$xǊ:z"uO([01;*#f܋	D݂S)U
 0GMOQ48hjп-L/URoF97]_J[~lXa%ḣ׃{rڌ
E}FM,*z	(TZ~N:b֕C2xaAۑ΂N~jn)X[8aʛQߊPE#߰:6P+5)/tlL<|X/2MgԻnT*5NPI~=_ΪBN
+@!)%5~J"r½4sEGOk
[C杖c[Jr<8ee~9t&K3RN,:sm"]@׀B@' bPgKIX$*6'N% E&-Z"z7K&V!5fGZc%"Up
2YMM|[ -E1(G";GNVNuFlIL315RrulȂO<s
7\b/"Ɓ5yvߴ&wl @ `ǌ2&2b\a&[Czs
:a5b=FkHP*/(E>7Xͬ8ލ1B|N!ʿL.[>Ti&lǼ(h.S,5Y$qI}E'9 }#ٶ
a4@szIrem$h%Jw8utviO1?>	w?y<oL5[_)[AuXyt#p
s j
a%Ӄ+v[lI,CCn[}wXznm8~RS&\ht|wG3\3*glIP֤1hT}-eD6=dİ]&MM*7_!	jCsh-ܹwf1+ dEGkJ4YH$Y~^xOȴA9v}okq CXSTykfi
3-H2iPtS.B
y
d|Dt@`oaa;?{7.qA&FwaG-VXצTLtgoise>ǢnJ-SC&kY/unddvZWƈ[j:*>;m-\ezfoB7@t(-ַHtXq<!ӛ9t$lA -'b">dMW4|,l4?e
(3ٜ=)WQ
[D:(W>Ὠ10ݣMzSUC6nN_]L)wt>zN89[3JU!</ݿU |#{#\FJsSf6J[Y:[T=r)(?/*Fl9&HQ:cK{rIeETA]2E|WF"9ʆˈ@,	hAzW0SILʒ3 XYE46
t~^o;F<y+cRQYNzwgW"Nu
o>&I2#OO8{ol&άo!
+/CgŠZDS6si &TbȮ`c]3M"bxɨNƒ!!	>-<!1aQ5@;4?f$`]ˈw6VGBo&;zk/#sf	TL$
72Mߛ]6*k.F3ȦIz1w2m:Q]33ӬCE.(KT<<T'-yk
58/DyvRNOEmiW]'$B\pn*
o8:mP
MHd]±Y7KiRGz-rcTO|)m%5l;%PAaU+(28Q9*s<Ʋ	\3ȱ_$AX
4.ļ@
I@7	݌2`X+\n/$AQr$7xۧ.Go[bm"5

G^gs-ž#A1MZ_Fc%O8/) S}Q_,'f4&wZ71Ey=&Y;=k|yku7AZjGL|Ч[?G~2
<>=@1>,3:+iN_yfS6RlYպ͐uP'@Wr	m(!~Hܐ1yx:?y Úl+4B#}ɪV?_HqݯLK8ޅrc:9Q׀\(6$lQIJ0\WE@T9]m*[1dꓸ.	Wr_!!N|L$ol.~K2QEwGa5<8Qob0/:>}/_ܻ] RMÙк5$27Bظ(J9y6E b"ʗY!]!+KrDj}єu^Q|'L"@XbP&KRbC/2[콖MmW fZh>Rtiۧ@Mu/l-1Nc}kw]@uѴlo)֘tNr_y]Wٗ\fJ*7@,v>IO`>6AwJQr~%bI mx|.wEGf#X{XJr{rKU1&ĤA-IrOI
-iv!IV˶C[cZ,{x>bY[aSOn37FBۂݗ@`|ˎr//肗|ZeVfp	B@$Rd#GӐYK~.ui4Tuk}xQ1 nȪߙ(Aob3`f*ǅ瓁`o \!`Z_/;mxj=f\߀X*&/#z^X()Y{tMPvMVv\7(88Rvhv$4ʲ@;p,O989wD>j
mg;46ky	;9c}*>罣1n\ٸoW+eHoT;LT"EN)׬ʂ>z~ogN٨"9)t(֤~]r.qޅp
2VKǳy>-j*U+~v2*/gwF*j*Sc	ܥI񞏔:wdHUQg:4ĒK]Z!ql#d\(&bu΋=;Rc#e2+`n&	<0+$طH9ظ<-Rd=!7?
rR}c&R:n
%ɢÎ*Яf`BZ;(UO#sLbG+c4m!D
>o,LT3zr_\ºAZ{a~ɚ 	jso*aE)uzCv7&[eL+On,oϔ%D"YZ_U>ģpX#0eX)bmM:RQ2v5GHxѥ|/ïL-ʨ
1ysreDʕ/3I7&&BGhQm?94!S3uֱ]fs/*T%8# &	=w7@}2UI5tM'HZ&VK8
{pPPﺟ$'n\ZMz`ҴL^Cg'-p΂V{`?{@`
.[@mf'>AwwA%[vljB|R"lrg0
e2OY8~]tiQL<qpѽV|a5*?̬zawzk ;%jp܂[}m@QnV
liLdތomݽie*셅ZX="Z
XdM"Hov0P@u0FMYBI*t2dk(dALiy~kd|"'Ϙy+Da5wxP4lg < =»lqӾo!v35d6sk~TT= O}dK1õjr*Ms'D379N?V@yiR]<3և
כՖ3oQ)PҞܫunFŌYْřngB;3Jg^n-l0tGAEzqn,k&z{`n3@ygDG!PvDl`ޛ)uqD2oYgٻ'?\]@'сtaNPkܬ?*=?\&AraY*jl<06FxCH/tQפOƋ|V>| Vor	WUW@yN\7
_igUozpNvk80zhR<-2]/V5^J@Z쁲X(<5Vv@>"4hULJK W2W7wLx03؀Nk!Hm9K}=+ڎE	S(DCv
	27q( NǵZBP-rP: -Hv T͆gH(U#ߎ0a׷Z;kC^!(-('( hxΗ48/Pǔ[2(J]#Ut\]FmZ|Fv*4$VÓPcbyPz}~]'q-ZexKb0]PZ
Q5kJ2U!R,&g+QCȡT׎yE~ l:'
u-Kb
vFF4ɝͿt^*+Mea: XV)@%b_~ѭ5rbvd?RaA{ȧLC'AwFḅnXt;21y,)N,ka+aZ;0݅@SR	:qfQBMJȔ\m6xqZSY*Γ~Q9הeoab;@ݙߥVa]mϡE֩sFf$IhM;az&Q+oygtd IͿm.#RO<oGz|	]2q~VYGY`cRyn>9#F#.G0.#!;#y)og	7:  0c[t?eamuCʐ4Gky$˝!n^9?DưLPNx{^`h

>P*zr5@""EgP9ka}ή/r?xqep|>JS:@	1{9{2
9dAY(;'r7եԏk+'E¶@}y6>	m5	K2^*bJE[݀X]%3xvŢ?[QN0?E(HNkbJ!o
)au=ۗ{v/2у=w=t&MYF'=s3&>wc(waBvc싊&I6l$^~&dW @hu5j<IANKp<eNYD8ҭTeZ|py)
1&LpvS&4/lƌJ;]HJOpSSa9q WU`T.lml1/-}A$hTJZL\uMs(Ұ߃KN%V4ZA"6
OîfvJW&}Jwj
=PV\fQUgy97+{z}΋v1#*J&mV
kT(NՖ&k 񩙎麸bۇ*ySX`FÖɳ&-%s/|S7vFd+>Zoh
?;:CWeuUqnE<(c$PL)ʳ#MSn=%
S&uv!=FM.Wtל8r7z)ZsTR%6/вogr=pN2Ѹ9GwH9^=o,3r_B^N|Uؠ
Px75%AI D7ĶLCHQA1QϞhj-`SۓxµVtS\P!Mk#/daaW5m'>7%XdŠ>+er<mQC_;.r?SZlH9}iVc)O"4_tJnHiހX~?M17妿N7q "xKxSc!Hg%SIHfW{fpsf!BݯJ۪(wcC6X$2pk{O{Q/gDixp\N}?WR]]o"G5E:R(m~ik.uܒ形E6&ɡfnO?1H+d$`e~%%2˴gKÞw	[e)jjW.|d3CiK԰!ss&*UvBw +WRW'IMTPK8TTB1z>_>B8)m̪0@y*o[*H!bciEƩ ;(}{L
gXJ
ՇS)RؠϯXArx1 e+b&|n^ 7mHof 301#	y
'?m[v4ށkg_ dE *?4|((h	^f2n2"I
͈'u5D`%6'
os ICcu7ތe`ґ<ƖP=?
ݙe0N~3W 9	^}!_(s9`r~)":rq;C>.Oc^R^S@V|
2uU%kqP9m
{?2Ql,#5OW#̈́0LaMJD
)1[^&	B멱M*Vi/L}y:0*B?*
3
W.#JT),ƭekz	FVI>bfyB@&wAD=Tң={VGEHW;"n_|-ҖQ(c#@G|>UTI&&֔;(#Xk(+\]F3/Iup'%`͂Љ'v7jBJ~-03mU:J	]W!h*8M=<.A%`F4U1ʥrD(r-ƄMd-[#3"n
{aw\;Dw֮>Ux}jj$!J*VO&R.+䆩Dއjv঳'_	
:$P*Ѐ)ietU?XMyl(aUMyod]
^)!8LeiP0Y7*GJT?yؔ[+0`Bs!dQ[˯rCَhKn53;<}b|B(,O|k?ͧڡ^. ,{	 ,T)y?dN;Ag*&L2 4)MK!b#'#k( 	sY jOoZ*xl!p1ԝ.+P%3;,Ix!g"E
 Ajf8x3<O1Éʉ|Eҵ=s>gJ7gYG5Y,j/+s8&]6=f9p߿׆Yg3Xkal
w29cڗKk>{.o`N\lt~R̊1)BŅbӛ\uIƐ<X&}Anr{d䄽u-W;дq6|ᢓmj:.>TtWNp,Nt
X8i{>}yhm6ءzXLsR$ޚ 2!bb]U\[)nP6.Pp*Oz Mgb(<׎0Xqv0
O.KHTipFێTY9_ӫqRN|ˎ
"qin?sbEc|$w@aw R4ugL'i|jZ6hN@s7~|4"/%Թ}/ ;DJ(Z+ddm"s
qO:ËWg(^bvʴʉ7UTUL6lLP	WͶxn'Z"NKi7_j`B,vzUGݾ>FLV45isFFѻr&a{_EOID#(vK?|IxEl*dN|C`B[L/Sxdd
hKlpGӱTeh0 c%7nHih
s8n]PF=7xY~x[rEoݯV.z9mSO4+#`G}O(cM1A^ma9zcrH]$z2Wo(TQKD5]y	1*!e=tORt:B[:t%Ī쮧Oe{o&HVaDzc*(Vrg}{iK<VopI;0\aNusL)U!)9{L@s?s5*3tw0
['b"
`
HAC#hC
Y o-g%q={8mSvv$FX邓QsfKoBwUS+	&-}.@-=EJ*6\oؕGi[t2@#=8^,Ns5=.͍|nN0:n 	HOn,nҰs(/D@b7/}
,
t{7K
sa(`pTO܅4Sfn%uP[ψ!ް1f9flmlC4!脱)t>ߦ6'#v7ʶ5ZLUM;@m{x6ݴ|Kת[	l:ilmkmISQ._koSlhn[YbiY$u=^ofZr=NY,f	&RvL&:O¦B+BHkXw3	 |IYtW ^1|AY:ƀ g	-L^ӳ7jqDSCѠ1hNRIXv~ȱgxr Ջj<kϨ,h.*P3`
CV"eEr$qk8S@@van c)?(ǰ;O6BmCF_7̾L\P"
O(Wl$p sA*|찋ɎlPFˠm7Q+6A +h#o,oQ̗8Qo>jG!+9~M{?;W]EwsL囹LȪ}1Lۧ>KQ+%t14@*Xr
>Nhuq`J٤*(74)4=	OULL	7]/h6?-j:&l3#`rܴ"epnPU*/RtT@1']B=Xu~/#^Q9}^:
Q-z)&㵘|k\C[ΈJf2/6^+[ݪZ=dU:WTw9&1yk6D8,SQYXDNS̍bY~v{(.0TW-(lI-#륹7{BQ^ێn~!QdګN! P|&bd?\Sqr6*I
A[ҊpwS
r∦bq	Y$!NuDqI{>VE%J+:]bm[嗑H 
bd}[Ө,t
 PM0Xоx7ϋ,.eMՀ=E೴w<ٖW_QdPZ1T%YBXQJɧ$/3 t(&O;-'Yђ$#o\,7]ҵz&	Wb8a|-gfhKP/V8jfަ@T !\Y"*OJrb;m^v,\uX`_%E,U"(̋A4wyɈ4`U?+YG9h%d]y-=Uś
Q\w)R9,Ngq|QDd8L[|?b4TJ<xQЎBtI뼸`FsL͚2L]_^% `ʵ$2zN?E~~OQzs\H$
zfAٝw$컞A	Pxl $5itMWђ:zѪCMr?Vj˅|ci	>=kW;Q,VgyInqw)+KWic:[va)ۀWCHԃSD^,R r62UJҼ;&xEmB.K9@`u'r^0w~5*"T/ipBh}!ᯔ<5vB[|
$=~[outAk
ҢAyz b7]

yU%_#j4c.:x_
ڐQD/]mXfhoCs#.'ߎ''A#\85nj]CMO^ￋzQ#~ϭ[ܢƒ#ZG=QgENy.b%X&fȦFm<O2u|"c/6LY,ߧW{ :H_/_dr"eL>'&is]9D{㽤Nm D;0=ϖC%YlO!+ȇr~
Ć% *9|I:ڞu$xZW<՚/-Zcmg;M|C^K({_0 GH=V&5MW8?鵎ډ v2LEg%4!a$j6$uNJ3WFDYƳ[.GлIcjWFG@'ax4I@@4Z͌,k |7zǯ\Ca8m!nG?48Z
9(oqtgBv|zH994+QE9+e&s&2E[E 1- $޹dJ:F6Oe+>ln֦:{5lw:d.듻WU
2+tS!p8=HqyB1!»wiNz2w_yjv:^ ަP Nce؍z(c!,K;hjth_%khjĪwM|vp@Bٌ̹cuH9{O7!}#VsL|UnL,-=g z
>쒈*EMmJƤKԌ1TV 7r/~aRx4(0AB󔝢я"
"Q-Y~S)Ac@hLyPƨa }^(゛ry+*7tq}rPqyBii:IWM=Ayث<iX.Βw)4nw	]ه˳{&,T|haI'nucn,, \ػRSSt'QBj"IGko!`3P<gzvr YA2;q,\ܔ
K.  LQCn9{v6}H˳,I{7`q/np'tc"_yYhK6Z+pnE
$#,&{xYQ$ŶCof[1Y`t+C9ʚ//>6;7mG:l.a>ex?4
PG$&}7@Ik,mh#u*IIzK
$"YWtg΅aW8I>",l`nYk)l]OlcŶB(e^*i}U+P/C8bM0۞M]i\m5aI?[~K0ڤ/ "GfoM3 ӋݺWOo(Ky+[Aiف1Pz̉iMo2z\d{	~Cz?F6M
:Z *e8K4%=MɺtL0F+|nVdԽW
3rf
`
$fƨ# | Jo;eu~Fk
N¥oИ-9^q `#\Zd;#x[̖ҸϏmրd1ˀyMe=%ұɘǶ-"<$T,l/M)U 6_'pi-gWm}LR7.5wA=z]Q㷠NBWK-þּ/?sJYMIY1C2tTB-u2֝c_vB$gEP7 pc9$-sMe \JE`k/(*0+b;/8F$i阯FXa`siJHҤR32SØsB[=(7-6o:ŵ*U[m@Pyqr~+%H]XeNk.:ob>w
R˦bRܛhSNV[=ix	>`7\'(vֱ80X#rx2q  ߷0Ɩkept1"
<\zyt\a\pz3.Z[
q1Sl$Xt?T-d)TJ2:0LG$ER"Fa&	ՉQOUyN1I`~gB#'aD/^UCjEQod	fٮ|&+g.7ptn95Äט] /bc~Am.IN+X
?J9kGyʇ*d{avM4-?#x1\1
D:Ɍ=cOQP~EF*6ˡ63,6}&>SR
Q@9czv"^BO0H@V&%sL1މAT	]ۀ5eY>)>=AKP"ng8wK=J't"*HX.;%w͍+T3 k<=MHêrpw
bI
[
K/|_Ռ`*fWnθ^}xŹQ9T45fxm`,=>gvj>A~:>ޠrW5ag_hٽy77=&	(c9~e
w
Wt0h>jõzDV-	{KtO2_-SxvSR D\EC*#IMɕ|v>=dH+БB2	(yge.Q<W"oQӡQU kـF(
*evOd=d.xn9"m	*$Ɗr&*$4~tJ,CqJ&dl$u^4yBX+ˋJ_Q/}孧V{FPoƜyۆ@=tkL[ѳݣOQ`eA
pYefTN^`1<ruשRCy}QKwbCAxH?\U6V/os/TЫ^~n+&T\<
Q~L6LiҀs;ӦD߿a=Rp@MvM"q*1mL0z[ddvSaVn6ﱲ00ы*m,7SNCPe΃Y,W(R<ro}=UOOb<ёr񈽄Pc{j|3uGOi
(M=@T< J#Z}Ԥ?^M-"=KOuwl&晎W}8;D#(u'˼<<
5eo 7Qw(vdkB5>p|`h>qSv|<ޤq$[HEc̎i01G3=OD;'S|:
/y#KƁm<6_}TRO񈗶QNׂ`'{
!'JKX<;0I+{mL)1A
-5v3fgfQI|u_B
fEmCQӣh
c'UAup=B(/[^_ xr0yFlP~ud_'=hY[ק=b@F^xYGCGp8j]Ka-MQ%
a
;ymsn
th֬"4me|I;Hsy8c pX?!0gqq2w`dNDukEz$3]1ej8׺|[QztLd1ȣ!)tdBM"m2K91#X+,4͑J5r̪p+13ڹWd'?³$ZQ!WƩc->ܪ6##]CE+)$]Sj+[^3[Njɚu.-x&@IۢŲɽScw"97pƆ3;{..9KT2$_L.UCe"vfzJ+J	<N.~z=wġ64~}IPr-
'(, !a7N\p	[@TwlZWBՋl\]!`cd+ny2"~DR8C2$N{Ag=7;mn7aZ:2]5/s^'	=\HTze^L=1(/4[o%Xne?O[cn)}5"@@ >^3B4ve3y9 Bk؄nH#NH:ۮ')#_y-gY<^b-.2=a(bBIʹh	|J>-Z}K@'Ñ=Z%롯@0{nxUj:~A<@%z-nA翄7c{8Bh?<urp|zWlO3}H~(e`xFTW3TR\*ƟE%m<]JK;X8|n7k ė^a˸$$lEl<ԗZߣdٍwbò
~>Y9#"h0
˦W-VD"A-0_p82X
YZi cs9y̡La^@ڦ2n9LG`1#{ĵ9}S=tz:k	b$Px<?fO"DgNp1Iyso}"ùӭ	+#`ŮbCQ	ܭ_3pi]4YT #dd%hnqr6km>VO^Iy64[)EZe(7Y)
M x6|ge	9ۨV5=guBj?ƫ~Ruxs󈂖xʲ%^at91a,Zӂrl2xBUc(<wy 3Ϻ+Gwݚ]8ܨ	k%T5sktXqHaWdGׅzH̻Q3ÃlV)'OC]	
P*աuA.ny:W#0Q;|s+ƶt!|DY;2Nl!p<d{J3js@u˼MSF~vI'^|"0µ),gÙ߫@md