it is likely the original packet was spoofing. Unfortunately, fingerprinting involves a high amount of overhead.
A host must send numerous probes and buffer suspicious
packets if the host requires sources be verified before processing the suspicious packets. Furthermore,
fingerprinting cannot identify spoofing packets if the
attacker uses the same operating system as the host located at the spoofed
address.