Also nmap uses fingerprinting on port scans to identify devices. Or attempt to, a lot of the time it doesn’t know, or says “Linux”