Re: State of p0f support

Robin Sommer <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <[email protected]>
To wrap this up: What I think I'm hearing is that there's certainly
opportunity for a much improved/modern version of such functionality,
but it also sounds like that nobody's is relying on that old
functionality anymore (not a surprise). So we'll go ahead and remove
the current p0f code in Zeek.

Robin

On Mon, Jun 17, 2019 at 13:45 -0700, I wrote:

> Looking for some input here.
> 
> Zeek has provided support for passive OS fingerprinting for a long
> time through p0f. However, we are using using a very outdated version
> of the p0f engine, and the signature set is likewise stale (last
> update from 2011!).
> 
> Unfortunately p0f has changed quite a bit in meantime, so that it's
> not easy to upgrade. While we'd certainly be happy to do that if
> anybody wanted to work on it, for now we are considering to remove the
> old engine that's currently shipping with Zeek because it doesn't seem
> to provide much value anymore.
> 
> Please chime in if that would be a problem for you. Is anybody still
> relying on the p0f support in Zeek as it is today?
> 
> Thanks,
> 
> Robin
> 
> 
> -- 
> Robin Sommer * Corelight, Inc. * [email protected] * www.corelight.com


-- 
Robin Sommer * Corelight, Inc. * [email protected] * www.corelight.com
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.