In their "completely rewritten" TCP stack for NT5, Microsoft uses 0x402E. Interestingly, that is exactly the number used by OpenBSD and FreeBSD.
-- article on tcp/ip stack fingerprinting.

after reading the 'case for win2k' posts, i thought i'd drop the above quote in.

one of the first things i noticed when i put win2kP onto my box on release was the speed of the tcp/ip stack.

it was phenominal after going fron nt4+win98.
i could believe they used the freebsd stack. certainly feels like it.


------------------
Stuart 'Dark Fiber' George [ FreeBSD 4.1 / BeOS 4.5.2 / Win2K ]
Write Your Own Operating System [FAQ]