我刚刚学习了操作系统指纹识别，当我 ping 某个 IP 地址时，它会给我一个 ttl 值 56。
值为 56 的操作系统是什么？我只知道流行的操作系统的 ttl 值，例如：Windows XP 为 128，FreeBSD 为 64，Linux 内核在 2.4 和 2.6 之间，等等
答案1
请注意，TTL 每次经过网络设备（例如路由器）时都会减少，如RFC 791
The time to live is set by the sender to the maximum time the
datagram is allowed to be in the internet system. If the datagram
is in the internet system longer than the time to live, then the
datagram must be destroyed.
This field must be decreased at each point that the internet header
is processed to reflect the time spent processing the datagram.
Even if no local information is available on the time actually
spent, the field must be decremented by 1. The time is measured in
units of seconds (i.e. the value 1 means one second). Thus, the
maximum time to live is 255 seconds or 4.25 minutes. Since every
module that processes a datagram must decrease the TTL by at least
one even if it process the datagram in less than a second, the TTL
must be thought of only as an upper bound on the time a datagram may
exist. The intention is to cause undeliverable datagrams to be
discarded, and to bound the maximum datagram lifetime.
Some higher level reliable connection protocols are based on
assumptions that old duplicate datagrams will not arrive after a
certain time elapses. The TTL is a way for such protocols to have
an assurance that their assumption is met.
此外，可以通过更改 Windows 中的注册表和使用 Linux 中的 iptables 轻松地欺骗 TTL，因此存在很多可能性，没有人可以肯定地说。