Satori uses Winpcap and captures packets passively at the NDIS level,
every packet flying by is scrutinised for information that might
determine it's OS.   It currently uses and parses the following protocols:  CDP, DHCP, EIGRP, HPSP, HTTP, ICMP, IGMP, MDNS, OSPF, IPX, SCCP, SMB, SNMP, STP, TCP (own format, p0fv2, ettercap), UPNP and others.