Determining operating system data is disclosed, including receiving a message associated with a network protocol, extracting a set of one or more features from the message, and determining operating system data at least in part by matching one or more features of the message with one or more features of a fingerprint associated with an operating system. An exact match of the features is not required to determine operating system data.