On our server we've seen many banned players attempt to evade their ban by using alternative Accounts. To combat this we analyze secondary traits, most notably their IP address. But building an effective anti-evasion system requires multiple datapoints that are hard for clients to spoof. That's what motivated this project.

SynSniff uses pcap to inspect incoming TCP/IP packets and correlates them with player joins by comparing source IP and port.

It then attempts to identify the player's operating system by comparing TCP/IP characteristics (like TCP options, window size) to reference samples from Linux, Windows and macOS. While the current detection logic is relatively simple, the results so far have been surprisingly accurate.

There's also an API for plugin developers to access fingerprint and OS data and integrate it into their systems.