The code and database are available on the NikolaiT/zardaxt GitHub repository .
When a new fingerprint arrives, Zardaxt calculates a against every entry in the database. The avgScoreOsClass aggregates these per‑OS scores, while bestNGuesses selects the top three matches. The scoring algorithm is transparent and deterministic, making it easy to understand why a particular OS was chosen.
: Instead of a simple "yes/no" match, Zardaxt assigns scores to OS classes based on how many features of the captured packet align with known OS signatures.
Before diving into "scoring links," it's crucial to understand the tool itself. is a modern, open-source passive TCP/IP fingerprinting tool . Its primary purpose is to identify the operating system of a client device just by examining the first network packet it sends—specifically, the SYN packet of the TCP 3-way handshake. zardaxt os scoring link
These parameters often differ significantly between desktop and mobile stacks. IP ID & TCP MSS (1.5 pts each): These provide further granular differentiation.
NikolaiT/zardaxt: Passive TCP/IP Fingerprinting Tool ... - GitHub
: The tool extracts high-entropy data from TCP header fields and options (like MSS, Window Scaling, and Timestamp). The code and database are available on the
Below is a sample output for an Android smartphone:
Source: GitHub documentation showing Zardaxt classifying an Android smartphone.
"avgScoreOsClass": "Android": "avg=6.27, N=779", "Chrome OS": "avg=5.0, N=8", "Linux": "avg=4.99, N=422", "Windows": "avg=2.64, N=1019", "iOS": "avg=3.66, N=447", "macOS": "avg=3.64, N=520" , "bestNGuesses": [ "os": "Android", "score": "9.0/10", "os": "Android", "score": "9.0/10", "os": "Android", "score": "9.0/10" ] is a modern, open-source passive TCP/IP fingerprinting tool
If you’ve seen references to a "Zardaxt OS scoring link" in logs or threat bulletins, here is exactly what is happening under the hood.
In the custom OS community, a "scoring link" typically refers to a shared database—often hosted on Google Sheets, GitHub, or a dedicated Discord bot—where users upload their benchmark results. These scores usually focus on: Measuring kernel-side latency.
| Tool | Approach | Active/Passive | Maintained | Scoring Detail | |---------------|------------------|----------------|------------|----------------| | Zardaxt | SYN packet only | Passive | Yes | Score per OS (0-10) | | p0f | SYN + SYN/ACK | Passive | No (dead) | Simple match only | | satori.py | Multi‑packet | Passive | Buggy | Limited | | Nmap | Multiple probes | Active | Yes | No per‑connection score |
: The OS category (e.g., Windows, Linux) with the top score.
