[javajosh]

Handy. Is the TCP handshake, or other details about socket behavior, ever get used for assessing the remote process, and in turn libraries written to mimic known patterns?

[tenebrisalietum]

Yes. https://nmap.org/book/osdetect-methods.html