OS fingerprinting Status
Federico Foschini <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAFRU1Xskx5kG1R6TE2d2O85GmkFAo5pvzmBarci4myu=5yU=yA@mail.gmail.com> |
Hello, Is there a way to fingerprinting operating systems in zeek? I have done some testing using *OS_version_found* event https://docs.zeek.org/en/stable/scripts/base/bif/event.bif.bro.html#id-OS_version_found and by modify this old script: https://github.com/ewust/telex/blob/master/telex-station/station/bro-1.5.1/policy/OS-fingerprint.bro But without much success. I stumpled upon the (WIP) release notes from Zeek 3.1.0 and read the following: - Removed p0f (passive OS fingerprinting) support. The version of p0f shipped with zeek was ancient, probably did not give any reliable support anymore and did not offer a clear upgrade path. The ``OS_version_found`` event as well as the ``generate_OS_version_event`` configuration option were removed. So I'm assuming my apprach it will be a failure. Is there another way to get OS information? Are there some zeek scripts that offer this functionality? -- Federico Foschini. _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek