TCP fingerprint

Before any data is exchanged, a device and a server set up a TCP connection. The client's first packet carries several technical values: the initial TTL, the window size, the maximum segment size and a set of TCP options in a particular order. Each operating system fills in these fields a little differently.

For example, Windows usually starts with a TTL of 128, while Linux, Android, macOS and iOS start with 64. The set of options and their sequence also differ. Together these details form a TCP fingerprint, from which a server can guess which OS is on the other side of the connection.

This kind of analysis is called passive: the server does not need to send anything, it only looks at the packets that arrive. The most widely known tool of this type is p0f, and similar checks are built into various site protection systems. The result is always approximate, because network settings and devices along the way can change the values.

With a proxy the picture is different. Your device opens a TCP connection only to the proxy, and a separate connection to the site is opened by the exit node. So the site sees the TCP fingerprint not of your computer but of the device the traffic leaves from: a server in a data center, or a home router or phone in the case of residential and mobile proxies.

This can create a mismatch. The browser's User-Agent header may say "Windows", while the TCP fingerprint of the connection looks like Linux, because the exit node runs Linux. A site may notice that these signals do not agree and take it into account in its own assessment.

Some values change even without a proxy. Each router along the path lowers the TTL by one, so the server sees a slightly smaller number and rounds it up to the nearest typical value. The segment size may shrink if traffic goes through a tunnel or a mobile network. Because of this, even an ordinary home connection does not always produce a "clean" fingerprint. That is why a single mismatch rarely decides anything on its own.

The TCP fingerprint complements the TLS fingerprint and the browser fingerprint: the first describes the network layer, the second the program, the third the browser environment. None of them gives a precise answer on its own, so sites look at the overall set of signals. Knowing this mechanism helps you understand why the same IP may be perceived differently from different devices.