> Last, as for the signature that may be different on the same computer if > control by a webbot, is that possible? I guess not as the TCP stack > isn't changed, but anyone know for sure? I am curious on that part.
It will only change if the application does a setsockopt() and changes the socket buffer size which can change the TCP window size (and the scaling) on some OSes. It wouldn't surprise me if Linux or Windows had a few more non-portable sockopts that diddle the TCP options which would confuse the passive fingerprinting. .mike
