the Porter's Handbook. :-)
and uses characteristics of the TCP stream to guess the OS running on the endpoints.