RE: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out

From: Matt Barrie (matt.barrie_at_sensorynetworks.com)
Date: 09/04/03

  • Next message: Thor Larholm: "Re: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out" 
    To: "'Andreas Gietl'" <a.gietl@e-admin.de>
Date: Thu, 4 Sep 2003 14:03:40 -0700

    Does it do DNS resolution on logfiles? If so, this may be a way of
    detecting.

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Andreas
    Gietl
    Sent: Thursday, September 04, 2003 12:43 PM
    To: thetic; Michal Zalewski; honeypots@securityfocus.com;
    pen-test@securityfocus.com; focus-ids@securityfocus.com;
    sectools@securityfocus.com
    Cc: incidents@securityfocus.com; bugtraq@securityfocus.com;
    full-disclosure@netsys.com
    Subject: Re: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out

    On Thursday 04 September 2003 20:19, thetic wrote:

    it i a passive scan-tool! you can't detect the scans because there are
    no
    packets going to you network.

    > Question concerning the the POF, how can we setup a IDS to detect a
    POF
    > scan.
    >
    > umer
    >
    >
    > ----- Original Message -----
    > From: "Michal Zalewski" <lcamtuf@ghettot.org>
    > To: <honeypots@securityfocus.com>; <pen-test@securityfocus.com>;
    > <focus-ids@securityfocus.com>; <sectools@securityfocus.com>
    > Cc: <incidents@securityfocus.com>; <bugtraq@securityfocus.com>;
    > <full-disclosure@netsys.com>
    > Sent: Wednesday, September 03, 2003 12:21 PM
    > Subject: [tool] the new p0f 2.0.1 is now out
    >
    > > I am proud to announce the new stable version of p0f, 2.0.1, a
    complete
    > > rewrite of the original open-source tool released back in 2000, and
    a
    > > major step for the utility.
    > >
    > > I apologize for posting to all the forums, and leave it to the
    moderators
    > > to accept or drop this post - but I believe the tool is probably of
    some
    > > interest to the IDS / honeypot / pen-test / general ITSec audiences,
    and
    > > more appropriate forums are largely defunct.
    > >
    > > ------------
    > > What is p0f?
    > > ------------
    > >
    > > P0f v2 is a versatile passive OS fingerprinting tool. P0f can
    identify
    > > the system on machines that connect to your box, machines you
    connect
    > > to, and even machines that merely go thru or near your box. All
    this
    > > even if the device is behind a fascist packet firewall.
    > >
    > > P0f will also detect what the remote system is hooked up to (be
    it
    > > Ethernet, DSL, OC3, or avian carriers), how far it is located,
    what's
    > > its uptime, and will often detect NAT, firewall presence, and
    even
    > > the name of the other guy's ISP - all this without sending a
    single
    > > packet.
    > >
    > > What do you need it for?
    > > ------------------------
    > >
    > > P0f is quite useful for gathering all kinds of profiling
    information
    > > about your users, customers or attackers (IDS, honeypot,
    firewall),
    > > tech espionage (laugh...), active or passive policy enforcement
    > > (restricting access for certain systems or otherwise handling
    them
    > > differently), content optimization, pen-testing, thru-firewall
    > > fingerprinting... plus all the tasks active fingerprinting is
    suitable
    > > for. And, of course, it has a high coolness factor, even if you
    are
    > > not a sysadmin.
    > >
    > > -----------
    > > What's new?
    > > -----------
    > >
    > > Almost everything. Please upgrade and encourage your vendor to
    > > update his packages. P0f v2 is far superior to the old code
    > > and its clones (such as the Ettercap passive OS fingerprinting
    > > functionality, based on the p0f v1 concepts). It is faster,
    > > more secure, reliable, precise, accurate, feature-loaded
    > > (including easy service integration). It also introduces many
    > > new metrics, some of them "invented" for p0f v2.
    > >
    > > NEW CORE CHECKS:
    > >
    > > - Option layout and count check,
    > > - EOL presence and trailing data [*],
    > > - Unrecognized options handling (TTCP, etc),
    > > - WSS to MSS/MTU correlation checks [*],
    > > - Zero timestamp check,
    > > - Non-zero ACK in initial SYN [*],
    > > - Non-zero "unused" TCP fields [*],
    > > - Non-zero urgent pointer in SYN [*],
    > > - Non-zero second timestamp [*],
    > > - Zero IP ID in initial packet,
    > > - Unusual auxilinary flags,
    > > - Data payload in control packets [*],
    > > - Non-empty IP options.
    > >
    > > [*] Metrics "invented" for p0f, as far as I know. Other metrics
    > > were discussed before, although usually not implemented
    anywhere.
    > >
    > > IMPROVEMENTS:
    > >
    > > - Major performance improvements - no more runtime signature
    parsing,
    > > added BPF pre-filtering, signature hash lookups - to make p0f
    >
    > suitable
    >
    > > for high-throughput devices,
    > >
    > > - Modulo and wildcard operators for certain TCP/IP parameters to
    make
    > > it easier to come up with generic last chance signatures for
    > > systems that tweak settings notoriously (think Windows),
    > >
    > > - Auto-detection of DF-zeroing firewalls,
    > >
    > > - Auto-detection of MSS-tweaking NAT and router devices,
    > >
    > > - Media type detection based on MSS, with a database of common
    > > link types,
    > >
    > > - Origin network detection based on unusual ToS / precedence
    bits,
    > >
    > > - Ability to detect and skip ECN option when examining flags,
    > >
    > > - Better fingerprint file structure and contents - all
    fingerprints
    > > are rigorously reviewed before being added.
    > >
    > > - Generic last-chance signatures to cover general OS
    characteristics,
    > >
    > > - Query mode to enable easy integration with third party
    software -
    > > p0f caches recent fingerprints and answer queries for src-dst
    > > combinations on a local stream socket in a easy to parse
    > > form,
    > >
    > > - Usability features: greppable output option, daemon mode, host
    > > name resolution option, promiscuous mode switch, built-in
    signature
    > > collision detector, ToS reporting, etc,
    > >
    > > - "Officially unsupported" SYN+ACK fingerprinting mode for
    silent
    > > identifications of systems you connect to the usual way (web
    > > browser, MTA),
    > >
    > > - Fixed WSCALE handling in general, and WSS passing on
    little-endian,
    > > many other bug-fixes and improvements of the packet parser
    > > (including some sanity checks).
    > >
    > > --------------------
    > > Download, demo, etc.
    > > --------------------
    > >
    > > P0f home page is:
    > > http://lcamtuf.coredump.cx/p0f.shtml
    > >
    > > Download:
    > > http://lcamtuf.coredump.cx/p0f.tgz
    > >
    > > Contribute / see it in action:
    > > http://lcamtuf.coredump.cx/p0f-help/
    > >
    > > P0f is believed to run fine on Windows, Linux, FreeBSD, NetBSD,
    > > OpenBSD, MacOS X, Solaris and AIX.
    > >
    > > Please consider contributing to the project if you liked it.
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html 

    -- 
e-admin internet gmbh
Andreas Gietl                                            tel +49 941
3810884
Ludwig-Thoma-Strasse 35                      fax +49 (0)1805/39160 -
29104
93051 Regensburg                                  mobil +49 171 6070008
PGP/GPG-Key unter http://www.e-admin.de/gpg.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Thor Larholm: "Re: [Full-Disclosure] Re: [tool] the new p0f 2.0.1 is now out"

    Relevant Pages

    • [tool] the new p0f 2.0.1 is now out
      ... P0f v2 is a versatile passive OS fingerprinting tool. ... the system on machines that connect to your box, ... even if the device is behind a fascist packet firewall. ...
      (Incidents)
    • [Full-Disclosure] [tool] the new p0f 2.0.1 is now out
      ... P0f v2 is a versatile passive OS fingerprinting tool. ... the system on machines that connect to your box, ... even if the device is behind a fascist packet firewall. ...
      (Full-Disclosure)
    • [Full-Disclosure] [tool] the new p0f 2.0.1 is now out
      ... P0f v2 is a versatile passive OS fingerprinting tool. ... the system on machines that connect to your box, ... even if the device is behind a fascist packet firewall. ...
      (Full-Disclosure)
    • [tool] the new p0f 2.0.1 is now out
      ... P0f v2 is a versatile passive OS fingerprinting tool. ... the system on machines that connect to your box, ... even if the device is behind a fascist packet firewall. ...
      (Pen-Test)
    • Re: [opensuse] dictionary attacks
      ... limit of the magic number of E-Mails, she couldn't connect to the SMTP ... server for 24 hours. ... SSHd is probably the wrong criteria, but detecting the IP of an incoming ... turning off that IP at the firewall could be effective. ...
      (SuSE)
    • Quantcast