enumerating hosts behind a NAT box

["Zuromski, Brian" <brzurom () tycho ncsc mil>]

hello,
         I'm trying to design a network mapping program and need to know if
there is a way to pickup (identify, count, os identification) any hosts
behind a NAT box. Also identifying a NAT box in the first place would be
useful.   Anyone have any luck doing so before or know of a way?

Thanks
~Brian