Passive host OS identifier using characteristics of sniffed traffic