The XY Problem

There’s no guarantee that every filename will have a three-letter extension,

so blindly grabbing three characters does not solve the problem. Obama: Look in the sourcecode for nmap, find how it figures out the Linux part, then rewrite your TCP/IP stack to not operate in a way nmap can detect. Obama: Well, nmap’s fingerprint is based on the way the TCP/IP stack works, there’s no real way except to rewrite the appropriate parts of said stack.

Source: xyproblem.info