Ofir Arkin
Israeli network security researcher who showed how much an operating system gives away simply by the way it answers ICMP.
In "ICMP Usage in Scanning" (2000–2001), Arkin catalogued how different TCP/IP stacks respond to odd ICMP packets: which fields they echo back, which errors they send and which they quietly swallow. The differences were enough to identify operating systems with surprising accuracy from just a handful of packets.
With Fyodor Yarochkin he built Xprobe around the technique, a complement to Nmap's TCP-based fingerprinting, and he ran the Sys-Security research group. The lesson firewall administrators took away: the protocol you forget to filter is the one that talks the most.