P0F(1)

NAME
p0f - identify remote systems passively

SYNOPSIS
p0f p0f [ -f file ] [ -i device ] [ -s file ] [ -o file ] [ -c size ] [ -Q socket ] [ -T nn ] [ -u user ] [ -w file ] [ -NVDUKALMqRtpdlx ] [ 'filter rule' ]

DESCRIPTION

p0f uses a fingerprinting technique based on analyzing the structure of a TCP/IP packet to determine the operating system and other configuration properties of a remote host. The process is completely passive and does not generate any suspicious network traffic. The other host has to either: - connect to your network - either spontaneously or in an induced manner, for example when trying to establish a ftp data stream, returning a bounced mail, performing auth lookup, using IRC DCC, external html mail image reference and so on, - or be contacted by some entity on your network using some standard means (such as a web browsing); it can either accept or refuse the connection.

The method can see thru packet firewalls and does not have the restrictions of an active fingerprinting. The main uses of passive OS fingerprinting are attacker profiling (IDS and honeypots), visitor profiling (content optimization), customer/user profiling (policy enforcement), pen-testing, etc.

OPTIONS

-f file
    Read fingerprints from a specified file. By default, p0f reads signatures from ./p0f.fp or /etc/p0f/p0f.fp for SYN (incoming connection) mode, and ./p0fr.fp and /etc/p0f/p0fr.fp for RST+ mode. Specifying multiple -f values will NOT combine several signature files together.

-i device
    Listen on a specified network device. P0f defaults to whatever device libpcap considers to be the best. On some newer systems, you may be able to specify 'any' to listen on all devices.

-s file
    Read packets from a tcpdump snapshot. This is an alternate mode of operation, useful for forensics.

-w file
    Writes matching SYN or SYN|ACK packets to a tcpdump snapshot. Useful for evidence gathering and further tcpdump / p0f analysis.

-o file
    Write to a given logfile. This option is required for -d and implies -t.

-Q socket
    Listen on a specified local stream socket (a filesystem object, for example /var/run/p0f-sock) for queries. You can later send a packet to this socket with p0f_query structure from p0f-query.h, and wait for p0f_response. This is a method of integrating p0f with active services (web server or web scripts, etc). P0f will still continue to report events the usual way, but you can use -qKU to suppress any text output. For a sample query client, check out test/p0fq.c supplied with the p0f sources. NOTE: The socket will be created with permissions corresponding to your current umask. If you want to restrict access to this interface, use caution.

-u user
    Chroot to this user's home directory after reading configuration data and binding to sockets, then switch to his UID, GID and supplementary groups. This is a security feature for the paranoid - when running p0f in daemon mode, you might want to create a new unprivileged user with an empty home directory, and limit the exposure when p0f is compromised.

-c size
    Use this cache size (default: 128) for -Q and -M options. Choose this value wisely - too high would affect your performance and result in too many -M false positives, too low would result in too many cache misses in -Q mode. The default is sane for a system with a moderate load (under 5-10 connections per second).

-N  No details - do not report distances and link media. This option logs only source IP and OS data.

-D  Do not report OS version information (just genre).

-U  Do not display unknown signatures. Use this option if you want to keep your log file clean and are not interested in hosts that are not recognized.

-K  Do not display known signatures. This option is only useful for fingerprint gathering.

-q  Be quiet - do not display banners.

-p  Switch card to promiscuous mode; by default, p0f listens only to packets addressed or routed thru the machine it runs on. This setting might decrease performance.

-t  Add date and time to every entry.

-d  Go into daemon mode. Requires -o.

-l  Output in a format that is easier to grep (record per line).

-A  Go into outgoing connection (SYN|ACK) mode. In this mode p0f will look for p0fa.fp file instead of the usual p0f.fp. The usual config is NOT SUITABLE for this mode. There is only a limited number of SYN|ACK signatures provided, because I do not have a maintainer for this file at the moment. Consider contributing if you find this mode useful.

-R  Go into connection refused (RST+ACK/RST) mode. In this mode, p0f will look for p0fr.fp file instead of the usual p0f.fp. All comments applicable to -A also apply here.

-r  Resolve host names; this mode is MUCH slower and poses some security risk. Do not use except for interactive runs or low traffic situations. NOTE: the option ONLY resolves IP address into a name, and does not perform any checks to verify this revDNS result. Do not rely on the name alone.

-C  Perform collision check on signatures prior to running. This is an essential option whenever you add new signatures to the p0f.fp file, but is not necessary otherwise. -M Run in masquerade detection mode. Using the cyclic query buffer, p0f looks for differences in OS characteristics for a single IP that would suggest there is a maquerade set up at this IP. By scoring different factors, p0f produces an estimate of masq probability, the higher it is, the more likely the result to be accurate.

-x  Dump full packet contents; this option is not compatible with -l and is intended for debugging and packet comparison only.

-M  Deploy masuqerade detection algotihm. The algorithm looks over recent (cached) hits and looks for indications of multiple systems being behind a single gateway. This is useful on routers and such to detect policy violations.

-T nn
    Set masquerade detection threshold at this value; only meaningful with -M.

-V  Use verbose reporting of all masquerade indicators (as opposed to simply reporting a summary score). Only meaningful with -M.

FILTERS
The last part, 'filter rule', is a bpf-style filter expression for incoming packets. It is very useful for excluding or including certain networks, hosts, or specific packets, in the logfile. See man tcpdump for more information, few examples: 'src port ftp-data' 'not dst net 10.0.0.0 mask 255.0.0.0' 'dst port 80 and ( src host 195.117.3.59 or src host 217.8.32.51 )' You also can use a companion log report utility for p0f. Simply run 'p0frep' for help.

SECURITY
P0f, due to its simplicity, is believed to be considerably secure than other software that is often being run for packet capture (tcpdump, Ettercap, etc). Please follow the security guidelines posted in the documentation supplied with the package.

BUGS
You need to consult the documentation for an up-to-date list of issues.

FILES

/etc/p0f/p0f.fp /etc/p0f/p0fa.fp /etc/p0f/p0fr.fp
    default fingerprint database files

AUTHOR
p0f was written by Michal Zalewski <lcamtuf@coredump.cx>. This man page was originally written by William Stearns <wstearns@pobox.com>, then adopted for p0f v2 by Michal Zalewski.