Можно nmap попробывать

# nmap -O 192.168.0.2

Starting Nmap 3.95 ( http://www.insecure.org/nmap/ ) at 2006-09-06 16:28 EEST
Interesting ports on 192.168.0.2:
(The 1663 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
3389/tcp open ms-term-serv
4899/tcp open radmin
13717/tcp open VeritasNetbackup
MAC Address: 00:30:48:52:D3:DC (Supermicro Computer)
Device type: general purpose
Running: Microsoft Windows NT/2K/XP|2003/.NET
OS details: Microsoft Windows 2003 Server, 2003 Server SP1 or XP Pro SP2

Nmap finished: 1 IP address (1 host up) scanned in 3.015 seconds

# nmap -O 192.168.0.1

Starting Nmap 3.95 ( http://www.insecure.org/nmap/ ) at 2006-09-06 16:31 EEST
Interesting ports on 192.168.0.1:
(The 1655 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
MAC Address: 00:30:48:83:E1:D9 (Supermicro Computer)
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux 2.4.0 - 2.5.20
Uptime 66.870 days (since Sat Jul 1 19:39:26 2006)

Nmap finished: 1 IP address (1 host up) scanned in 3.018 seconds

Правда вот точность оставляет желать лучшего.