Not OP but: Linux with TTL modified to look like Windows+1 to avoid tethering prevention gets actively proxied by an enterprise security/nat appliance. What fingerprint do you expect to see and what would you want to learn from it? That kind of thing.