Certified Ethical Hacker (CEH) Practice Question

A default initial TTL of 64 together with a TCP window size near 29200 and the MSS 1460/SACK/TS/WScale option set is the signature most commonly produced by contemporary Linux kernels (2.6/3.x/4.x). Windows desktop versions typically begin with TTL 128 and different window sizes (for example 8192 or 65535). FreeBSD uses a default window of 65535 and usually omits the Timestamp option unless selective ACKs are disabled. Cisco IOS devices normally start with TTL 255 and have markedly different option layouts. Therefore, the captured packet best matches a Linux host.