RFC 1413. "Identification Protocol," February 1993.
"P0F ”The Passive OS Fingerprinting Tool." (http://www.stearns.org/p0f)
The new p0f: 2.0.2 (C) Copyright 2000-2003, by Michal Zalewski. (http://lcamtuf.coredump.cx/p0f.shtml)
"Examining Advanced Remote OS Detection Methods/Concepts using Perl," by F0bic. (http://www.low-level.net)
"Nmap Remote OS Detection" by Fyodor, http://www. insecure .org. April 1999.
"ICMP Usage in Scanning," by Ofir Arkin.(http://www.sys-security.com)
"Xprobe v2.0: A `Fuzzy' Approach to Remote Active Operating System Fingerprinting," by Fyodor Yarochkin and Ofir Arkin.
"New Tool and Technique for Remote Operating System Fingerprinting," by Franck Veysset, Olivier Courtay, and Olivier Heen. Intranode Research Team.