An easy trick I use a lot is host OS identification via ICMP. A TTL of around 64 is Linux, ~128 is windows.