passive OS fingerprinting


  pass in proto tcp from any os windows \ 
    to port 25 rdr-to $spamtrap