Introduction: The Unique Signature
An IP address is like a name, but names can be changed. IP Fingerprinting is like looking at your gait or your DNA. It involves analyzing dozens of tiny technical details about your connection—like your 'Clock Skew', your 'MTU size', and your 'TCP Window'—to create a unique ID for you that is very hard to fake.
Why Use It?
Fingerprinting is used to catch hackers who think they are 'hidden' behind a VPN. Even if they change their IP, the technical 'fingerprint' of their computer usually stays the same, allowing security teams to track them across the web.
Conclusion
Fingerprinting is the ultimate 'Sherlock Holmes' of the internet. It finds the truth in the smallest digital details. See your own connection fingerprint here.
How passive TCP/IP fingerprinting works
Collectors observe SYN packets without completing handshakes, inferring OS families from option layouts (RFC 7414-style guidance on hardening). Enterprise NAC and CDN bot managers combine these signals with TLS JA fingerprints.
Limits
Carrier-grade NAT and middleboxes homogenize many subscribers; fingerprints drift after OS updates. Treat as probabilistic evidence paired with application-layer signals.
Read browser vs IP analysis.