How does Sinefa classify what Operating System a host is using?

In order to perform device/OS classification, Sinefa probes fingerprint the "user-agent" value in HTTP requests. Based on this value we can determine the OS the client (usually a browser) is running. Depending on the OS, the device itself and the browser type/version, sometimes we can narrow the classification down to a specific OS and version (e.g. Windows 8.1) but sometimes we can only determine the OS type (e.g. Windows). Also, sometimes there are false positives, e.g. when web proxies are involved or when browsers are run in certain modes (e.g. compatibility mode or developer mode).

We update our OS fingerprinting with each software release so new browser/OS combinations are detected soon after they are released.