-------------------------------------------------------------------------------
  NATDet - debug-mode
  -- for those who want to know more than others ;-)
-------------------------------------------------------------------------------

When you run NATDet with option -vv (debug mode) you're going to see some
"weird" entries like this:

[*] 23-03-2005 16:01:19: NAT at 192.168.0.1 for 2 system(s) [100%]
    Used factors: TTL OSGENRE TSTAMP
    [#0]["Linux 2.0", 64, 622729889 (6sec)] vs ["Windows NT", 127, 0]
     |    |           |   |                      |            |    |
     |    |           |   `-- TCP-timestamp -----|------------|----'
     |    |           `---- TTL -----------------|------------'
     |    `---------- OS genre ------------------'
     `-- entry number

NATDet is telling us that he compared two TCP/IP packets received from host
192.168.0.1. The first one (everything before "vs") is stored in NATDet cache
memory. In this case cache entry has number #0 and is filled with the data
for 6 seconds.
Everything after "vs" shows informations from the latest received packet.
As you can see, all values from these two packets differ. When TCP-timestamp
in received packet is lower than in cached packet then TSTAMP factor occurs.

-- Marcin Ulikowski <elceef@itsec.pl>

