ARP Neighbor Cache Fingerprinter is a tool that provides a mechanism for remote operating system detection by extrapolating characteristics of the target system's underlying neighbor cache and general ARP behavior. Given the non-existence of any standard specification for how the neighbor cache should behave, several differences in network stack implementations can be used for unique identification. The main disadvantage of this tool versus traditional fingerprinting is that because it's based on a Layer 2 protocol instead of a Layer 3 protocol, the target machine that is being tested must reside on the same Ethernet broadcast domain (usually the same physical network).
