to guess os we use TTL information and nmap script parser can use both TSV format nad tcpdump ascii format