FW: p0f3 release candidate
jhell at DataIX.net
Fri Jan 13 05:49:20 UTC 2012
Ports maintainers and other ideals might be interested in the following.
It purely needs more eyes at this point.
----- Forwarded message from Michal Zalewski <lcamtuf at coredump.cx> -----
Date: Tue, 10 Jan 2012 01:23:08 -0800
From: Michal Zalewski <lcamtuf at coredump.cx>
To: bugtraq <bugtraq at securityfocus.com>, full-disclosure
<full-disclosure at lists.grok.org.uk>
Subject: [Full-disclosure] p0f3 release candidate
I wanted to share the news of p0f v3, a complete rewrite and redesign
of my passive fingerprinting tool.
== Synopsis ==
P0f is a tool that utilizes an array of sophisticated, purely passive
traffic fingerprinting mechanisms to identify the players behind any
incidental TCP/IP communications (often as little as a single normal
SYN) without interfering in any way. Some of its capabilities include:
- Scalable and fast identification of the operating system and
software on both endpoints of a vanilla TCP connection - especially in
settings where NMap probes are blocked, too slow, unreliable, or would
simply set off alarms.
- Measurement of system uptime and network hookup, distance (including
topology behind NAT or packet filters), user language preferences, and
- Automated detection of connection sharing / NAT, load balancing, and
application-level proxying setups,
- Detection of dishonest clients / servers that forge declarative
statements such as X-Mailer or User-Agent.
The tool can be operated in the foreground or as a daemon, and offers
a simple real-time API for third-party components that wish to obtain
additional information about the actors they are talking to.
Common uses for p0f include reconnaissance during penetration tests;
routine network monitoring; detection of unauthorized network
interconnects in corporate environments; providing signals for abuse
prevention tools; and miscellaneous forensics.
== What's new ==
Version 3 is a complete rewrite, bringing you much improved SYN and
SYN+ACK fingerprinting capabilities, auto-calibrated uptime
measurements, completely redone databases and signatures, new API
design, IPv6 support (who knows, maybe it even works?), stateful
traffic inspection with thorough cross-correlation of collected data,
application-level fingerprinting modules (for HTTP now, more to come),
and a lot more.
== Download / demo ==
This is a "release candidate", and my hope is to get folks to
contribute signatures and help squash bugs. If all goes according to
plan, this should progress to a final release in a week or two. Some
issues are expected, so please report problems off-the-list.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
----- End forwarded message -----
More information about the freebsd-ports