ttmap passively analyzes values of TCP Timestamps
in captured IP packets. After collecting enough
data, it computes characteristic remote machine
parameters. These values let it guess remote
operating systems and identify unique machines
behind a single IP address. For example, it can
analyze remote IP load-balanced clusters.