Remote OS Detection using LPD Querying - Line printer daemons listening on TCP port 515 can give away information about which OS is running. Proof of concept code which contains a database of LPD returned messages and OS matches here.
cded128bdfd32167081a2f12af24098e14d48c17d622174b582fc793b3e6d45d