Hello,
On Thu, May 25, 2023 at 08:12:38PM +0300, ???????? ???????????? wrote:
> Thank you for looking, then another question: will you develop this
> functional, or it will stay as is?
I need to get familiar with fingerprints first. As Stuart said
it's not just being used by pf but also by tcpdump. Will definitely
try, but can not promise anything. It's new area for me.
regards
sashan
>
> ????, 25 ?????? 2023?????. ?? 18:54, Stuart Henderson <s...@spacehopper.org>:
>
> > On 2023/05/25 17:40, Alexandr Nedvedicky wrote:
> > > Hello,
> > >
> > > I took a look at signatures:
> > > > https://tools.netsa.cert.org/p0f/p0f.fp.2012032901 signatures file
> > (pf.os),
> > >
> > > This change is not about updating parser it looks like it will
> > > also require to update matching stuff in kernel. I have not looked
> > > at all details yet.
> >
> > as well as PF, this database is used by tcpdump (-o).
> >
> > quirks were added in p0f v2.x (p0f upstream is now at version 3.x which
> > has a completely different database).
> >
> > (p0f 2.x is in ports)
