Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the fingerprints file doesn't identify a lot of TCP SYN packets all that accurately.
I found a p0f v2 fingerprints file that used to be maintained by CMU's Software Engineering Institute, but I can't find any v3 fingerprint files. Do other people/organizations produce updated fingerprints files for p0f v3?
I checked out Fingerbank's fp file and the fingerprints are the same fingerprints from 3.09b distribution. The number in the labels relates to the id of the device table in the downloadable fingerbank sqlite database, so these can be easily cross referenced but provide less detailed information than the labels in the 3.09b fp file.
Fingerbank maintain a database of DHCP fingerprints so it's unlikely their fp file will be maintained.
Yes, you will find a fp-file on this site: https://fingerbank.inverse.ca/download. The fingerprints are readable, but the labels of the operating systems are missing. So it's not really good. I hope they will update this db with actual values and correct label from the contributors. Also the actual version of p0f have some new more fingerprints (http://lcamtuf.coredump.cx/p0f3/releases/p0f-3.09b.tgz).
