vFeed


Tools no image

Published on May 28th, 2014 | by MaxiSoler

0

p0f v3.07b Released

P0f is a tool that utilizes an array of sophisticated, purely passive traffic fingerprinting mechanisms to identify the players behind any incidental TCP/IP communications (often as little as a single normal SYN) without interfering in any way.

Some of p0f’s capabilities include:

  • Highly scalable and extremely fast identification of the operating system and software on both endpoints of a vanilla TCP connection – especially in settings where NMap probes are blocked, too slow, unreliable, or would simply set off alarms.
  • Measurement of system uptime and network hookup, distance (including topology behind NAT or packet filters), user language preferences, and so on.
  • Automated detection of connection sharing / NAT, load balancing, and application-level proxying setups.
  • Detection of clients and servers that forge declarative statements such as X-Mailer or User-Agent.

The tool can be operated in the foreground or as a daemon, and offers a simple real-time API for third-party components that wish to obtain additional information about the actors they are talking to.

Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellanous forensics.

 

Changelog v3.07b

Bug fixes:

  • Improvement to API handling to avoid FATAL() on short API reads & writes.
  • Minor bug fix to IP parsing in one of the companion utilities.

Improvements:

  • New signatures.

More Information: here

Download p0f v3.07b

 

Tags: , ,


About the Author

www.artssec.com @maxisoler



Back to Top ↑