How does Nmap infer a target operating system during OS detection?
It treats the conventional service name of one port as definitive OS proof.
It sends crafted packets and compares TCP/IP response characteristics with known OS fingerprints.
It reads the target's operating-system files over an authenticated shell.
It derives the OS solely from the target's DNS hostname.