zibeli2 wrote:
How does netcraft work, anyway?
Apparently they make HTTP requests to your site, and then dissect the TCP packets sent back from your server.
First, they match the characteristics of your packets against some sort of OS fingerprint (like what nmap does) to figure out your OS.
Then they look at the "TCP timestamp" option enclosed within the TCP packet your server returns. This timestamp gets incremented over time (i.e. TCP timestamp is roughly a function of uptime), so if they make separate HTTP requests to your site over a few days / weeks, they can plot how your server's TCP timestamp is being incremented over that period.
Each OS has its own way of incrementing the timestamp (i.e. for each OS, the function of timestamp against uptime is different). Now if they combine their knowledge of what your OS is with what they've gathered about how your TCP timestamp changes over time, they'll be able to figure out your uptime.
The gory details are in
this monumental BugTraq mail.
With a 2.6 UML kernel, I guess its network characteristics are so radically different from regular Linux kernels that netcraft just flags the OS as "unknown". Without an ID on your operating system, they won't be able to deduce uptime.