State of p0f support

Robin Sommer <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <[email protected]>
Looking for some input here.

Zeek has provided support for passive OS fingerprinting for a long
time through p0f. However, we are using using a very outdated version
of the p0f engine, and the signature set is likewise stale (last
update from 2011!).

Unfortunately p0f has changed quite a bit in meantime, so that it's
not easy to upgrade. While we'd certainly be happy to do that if
anybody wanted to work on it, for now we are considering to remove the
old engine that's currently shipping with Zeek because it doesn't seem
to provide much value anymore.

Please chime in if that would be a problem for you. Is anybody still
relying on the p0f support in Zeek as it is today?

Thanks,

Robin


-- 
Robin Sommer * Corelight, Inc. * [email protected] * www.corelight.com
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.