Windows TCP/IP Fingerprint

Every connection from every Stat Proxies IP carries the TCP/IP fingerprint of a Windows 11 PC. It is included free on every plan, it works over HTTP, HTTPS, and SOCKS5, and there is nothing to turn on.

What it is

The first packet of every TCP connection (the SYN) carries values that depend on the operating system that sent it: the TTL, the window size, the order of the TCP options, whether timestamps are on, and the source port. A website can read those values and tell Windows, macOS, and Linux apart. Through a proxy, the website sees the proxy server’s packets, not yours. Proxy servers usually run Linux, so proxy traffic usually reads as Linux even when your browser says Windows. Our servers send Windows values instead.

Field	Stock Linux server	Stat Proxies	Windows 11 PC
TTL sent	64	128	128
SYN window size	64240	65535	65535
Window scale	7	8	8
TCP option order	mss, sackOK, ts, nop, wscale	mss, nop, wscale, nop, nop, sackOK	mss, nop, wscale, nop, nop, sackOK
TCP timestamps	On	Off	Off
Source ports	32768-60999	49152-65535	49152-65535

What it covers

Windows fingerprint

Every TCP connection our servers open to a website: HTTP and HTTPS proxy traffic, and TCP over SOCKS5 (WebSockets, SSH, email, and so on). Every IP, every plan.

Comes from your client

Your TLS fingerprint (JA3, JA4), HTTP/2 settings, headers, user agent, and browser fingerprint. UDP over SOCKS5 has no TCP handshake, so it has no TCP fingerprint.

If your user agent says macOS, iPhone, or Android, the TCP layer will still say Windows. Send a Windows user agent for the cleanest match.

Check it

tls.peet.ws echoes back the fingerprint of whatever connects to it. Send one request through your proxy and read tcpip.tcp_syn. Use the host, port, username, and password from your dashboard.

cURL
Python

curl -s -x http://USERNAME:PASSWORD@HOST:PORT \
  https://tls.peet.ws/api/all | jq .tcpip.tcp_syn

import requests

proxy = "http://USERNAME:PASSWORD@HOST:PORT"
r = requests.get(
    "https://tls.peet.ws/api/all",
    proxies={"http": proxy, "https": proxy},
    timeout=20,
)
syn = r.json()["tcpip"]["tcp_syn"]
print(syn["ttl"], syn["window"], syn["window_scale"], syn["timestamps"], syn["option_order"])

You should see:

Field	Expected value
`ttl`	About 110 to 125 (128 minus one per network hop)
`window`	`65535`
`window_scale`	`8`
`timestamps`	`false`
`option_order`	`mss,nop,wscale,nop,nop,sackOK`
`src_port`	49152 or higher

If you see a TTL under 64 or timestamps: true, the request did not go through a Stat Proxies IP. Check that your client is actually using the proxy, then contact support if it still looks wrong.

FAQ

Does it cost extra?

No. It is included on every IP on every plan, the same as SOCKS5.

Do I need to change my username, port, or headers?

No. Every connection already carries the Windows fingerprint.

Does it add latency?

No measurable latency. The values are set inside our servers’ network stack as each connection opens.

Will it get me past Cloudflare or other anti-bot systems?

It removes one signal, a Windows browser arriving on a Linux TCP stack. Anti-bot systems also score IP history, TLS fingerprint, browser environment, and behavior. See Blocked Requests for the rest.

For background, read What is TCP/IP fingerprinting? on our blog.

Getting Started

Integration Guides

Troubleshooting

Billing & Account

Windows TCP/IP Fingerprint

What it is

What it covers

Windows fingerprint

Comes from your client

Check it

FAQ

​What it is

​What it covers

Windows fingerprint

Comes from your client

​Check it

​FAQ

What it is

What it covers

Check it

FAQ