full-disclosure - Re: [tool] the new p0f 2.0.1 is now out

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030905095216.D88991-100000@dekadens.ghettot.org>
From: lcamtuf at ghettot.org (Michal Zalewski)
Subject: Re: [tool] the new p0f 2.0.1 is now out

On Thu, 4 Sep 2003, morning_wood wrote:

> i have used ..
>
> Archaeopteryx v.1.0
>     Copyright C 1999-2001, Sektor:Security
> Archaeopteryx is a Passive mode OS Identification Tool.

Siphon (on which this tool is, err, 'based', so to speak) was a very
simple proof of concept utility. Neither Siphon, nor many other commercial
and non-commercial passive OS fingerprinters (standalone or built-in),
ever evolved past the point of checking DF and window size, and are hardly
kept up to date, with a handful of vague signatures.

P0f checks a total of over 20 packet characteristics, detects many complex
dependencies (such as wss-mss correlation, a common practice nowadays)
and is capable of recognizing the effects of certain network
configurations and so on, is way more suited to work in a production
system, etc. It is far superior to other implementations I am aware of.

So there is no big deal, but the tool is an advance in this field, I
believe, and is the only seriously maintained and extended implementation
in the open-source area (and probably in the closed-source world, too)...
live with it ;-)

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-09-05 09:52 --