Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am learning how nmap operates by testing it with another workstation in my network. When I entered

nmap -v -A -sS 192.xxx.xxx.xxx

Part of the output produced the line below.

TCP Sequence Prediction: Difficulty=260 (Good luck!)

How is 260 calculated and what makes it difficult to predict the next sequence?

Any answer or reference would greatly be appreciated!

Thank you

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The topic of TCP sequence prediction is covered pretty well in the online Nmap book's OS detection page under "TCP Sequence Prediction." Essentially, statistical methods such as the Greatest Common Denominator (GCD) are used to predict the sequence's variability. There is more discussion on the OS detection methods page, and you can look at the code in osscan2.cc in the HostOsScan::makeTSeqFP function.

share|improve this answer
Perfect! Just what I was looking for. Thank you! –  tray Aug 1 '13 at 6:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.