The reported operating system may be different to the one you expected because:
The site is using a web proxy cache, such as Novell BorderManager FastCache, Inktomi Traffic Server or a server running the open source Squid software. In this situation we will be connecting to the reverse web proxy rather than the originating web server, so will detect the cache's O/S rather than the web server's.
The site is using a server load balancing device (SLB) like Cisco LocalDirector, Resonate Central Dispatch, BIG/ip, Intel IPivot Intelligent Broker, IBM Network Dispatcher, ArrowPoint Content Smart or Alteon WebSystems ACEdirector. Some of these SLBs handle the TCP connection themselves, so we detect the SLB's operating system. Others use TCP/IP packet level Network Address Translation techniques, where we detect the operating system of one of the back-end web servers.
The site is using a TCP connection-level proxy firewall, such as provided in the TIS Gauntlet, BorderWare, Raptor, CyberGuard or IBM SecureWay firewalls, or some other kind of HTTP level proxy. In these cases we will receive data from the intermediate machine rather than the web server, so detect the intermediate machine's operating system.
The site load shares across multiple servers using different operating systems with round robin DNS. In such cases each query might detect a different operating system.
The site has changed the default configuration of their TCP/IP stack, perhaps for performance reasons, or have an unusual LAN environment.
We made a mistake. If you see an operating system & web server combination reported that you know to be wrong, please e-mail us or fill in our report form.