netfilter: passive OS fingerprint xtables match