Remote OS Detection using LPD Querying - Line printer daemons listening on TCP port 515 can give away information about which OS is running. Proof of concept code which contains a database of LPD returned messages and OS matches here.
4e667a19a6fc4fd69e37e0ce2175a2da