If often bases this information on the DHCP request and observed http requests. Perhaps it hasn't seen any of this type of traffic, or perhaps something is confusing it. Some general info: https://meraki.cisco.com/blog/2009/09/os-fingerprinting/
... View more