[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20030905095216.D88991-100000@dekadens.ghettot.org>
Date: Fri, 5 Sep 2003 10:10:10 +0200 (CEST)
From: Michal Zalewski <lcamtuf@...ttot.org>
To: morning_wood <se_cur_ity@...mail.com>
Cc: full-disclosure@...ts.netsys.com, <incidents@...urityfocus.com>,
<bugtraq@...urityfocus.com>, <sectools@...urityfocus.com>,
<pen-test@...urityfocus.com>
Subject: Re: Re: [tool] the new p0f 2.0.1 is now out
On Thu, 4 Sep 2003, morning_wood wrote:
> i have used ..
>
> Archaeopteryx v.1.0
> Copyright C 1999-2001, Sektor:Security
> Archaeopteryx is a Passive mode OS Identification Tool.
Siphon (on which this tool is, err, 'based', so to speak) was a very
simple proof of concept utility. Neither Siphon, nor many other commercial
and non-commercial passive OS fingerprinters (standalone or built-in),
ever evolved past the point of checking DF and window size, and are hardly
kept up to date, with a handful of vague signatures.
P0f checks a total of over 20 packet characteristics, detects many complex
dependencies (such as wss-mss correlation, a common practice nowadays)
and is capable of recognizing the effects of certain network
configurations and so on, is way more suited to work in a production
system, etc. It is far superior to other implementations I am aware of.
So there is no big deal, but the tool is an advance in this field, I
believe, and is the only seriously maintained and extended implementation
in the open-source area (and probably in the closed-source world, too)...
live with it ;-)
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2003-09-05 09:52 --
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Powered by blists - more mailing lists