P0F(1)

💖 P0F(1) — like, the manual page, bestie 💖

okay so real quick: this is p0f, from the General Commands Manual section (section 1, for the nerds keeping score). It's a whole vibe. Let's get into it ✨

---

🌸 NAME 🌸

p0f — identify remote systems passively 🕵️♀️💅

---

🎀 SYNOPSIS 🎀

p0f p0f [ -f file ] [ -i device ] [ -r file ] [ -o file ] [ -s socket ]
[ -u user ] [ -S limit ] [ -t c,h ] [ -m c,h ] [ -pdL ] [ 'filter rule'
]

(no bestie, the doubled p0f p0f is not me being silly, that's literally what the page says, I'm not touching it 💀)

---

✨ DESCRIPTION ✨

so p0f uses a fingerprinting technique based on analyzing the structure of a TCP/IP packet to figure out the operating system and other configuration properties of a remote host. and the whole process is completely passive — it does not generate any suspicious network traffic. not a single suspicious packet. iconic behavior, honestly. 👑

the other host has to either:

• connect to your network — either spontaneously or in an induced manner, for example when trying to establish a ftp data stream, returning a bounced mail, performing auth lookup, using IRC DCC, external html mail image reference and so on, or
• be contacted by some entity on your network using some standard means (such as a web browsing); it can either accept or refuse the connection.

the method can see thru packet firewalls and does not have the restrictions of an active fingerprinting. the main uses of passive OS fingerprinting are attacker profiling (IDS and honeypots), visitor profiling (content optimization), customer/user profiling (policy enforcement), pen-testing, etc. main character energy fr fr 🌈

---

🦋 OPTIONS 🦋

• -f file — read fingerprints from file; by default, p0f reads signatures from ./p0f.fp or /etc/p0f/p0f.fp (the latter on Unix systems only). you can use this to load custom fingerprint data. ⚠️ Specifying multiple -f values will NOT combine several signature files together. not even a little. don't try it.
• -i device — listen on this device; p0f defaults to whatever device libpcap considers to be the best (and which often isn't 🙈). on some newer systems you might be able to specify 'any' to listen on all devices, but don't rely on this. ⚠️ Specifying multiple -i values will NOT cause p0f to listen on several interfaces at once.
• -r file — read packets from a tcpdump snapshot; this is an alternate mode of operation, where p0f reads packets from a pcap data capture file instead of a live network. useful for forensics (this will parse tcpdump -w output, for example). 💖 you can use Ethereal's text2pcap to convert human-readable packet traces to pcap files, if needed.
• -o file — write to this logfile. this option is required for -d and implies -t. 📝
• -s socket — listen on a specified local stream socket (a filesystem object, for example /var/run/p0f-sock) for queries. one can later send a packet to this socket with p0f_query structure from p0f-query.h, and wait for p0f_response. this is a method of integrating p0f with active services (web server or web scripts, etc). P0f will still continue to report signatures the usual way — but you can use -qKU combination to suppress this. also see -c notes. 🫶 a sample query tool (p0f-client) is provided in the tools/ subdirectory.

NOTE: The socket will be created with permissions corresponding to your current umask. If you want to restrict access to this interface, use caution. 🔒

• -u user — this option forces p0f to chroot to this user's home directory after reading configuration data and binding to sockets, then to switch to his UID, GID and supplementary groups. this is a security feature for the paranoid — when running p0f in daemon mode, you might want to create a new unprivileged user with an empty home directory, and limit the exposure when p0f is compromised. that said, should such a compromise occur, the attacker will still have a socket he can use for sniffing some network traffic (better than rm -rf /). 😭💀
• -p — switch card to promiscuous mode; by default, p0f listens only to packets addressed or routed thru the machine it runs on. this setting might decrease performance, depending on your network design and load. on switched networks, this usually has little or no effect.

Note that promiscuous mode on IP-enabled interfaces can be detected remotely, and is sometimes not welcome by network administrators. be so careful bestie 🙈

• -d — go into daemon mode (detach from current terminal and fork into background). Requires -o or -s. 🧚
• -L — lists all available interfaces, then quits. particularly useful on Windows, where the system-generated interface names are impossible to memorize. (ngl that's so real of them 💀)
• -S limit — Limit number of parallel API connections (default: 20)
• -t c,h — Set connection / host cache age limits (default: 30s,120m)
• -m c,h — Limit the number of active connections / hosts (default: 1000,10000)

---

🌈 FILTERS 🌈

the last part, 'filter rule', is a bpf-style filter expression for incoming packets. it is very useful for excluding or including certain networks, hosts, or specific packets, in the logfile. see man tcpdump for more information, few examples:

´src port ftp-data´

´not dst net 10.0.0.0 mask 255.0.0.0´

´dst port 80 and ( src host 195.117.3.59 or src host 217.8.32.51 )´

---

💀 BUGS 💀

you need to consult the documentation for an up-to-date list of issues. (iykyk, they're not gonna list them here bestie 😭)

---

🍓 FILES 🍓

• /etc/p0f/p0f.fp — default fingerprint database file 📁

---

👑 AUTHOR 👑

p0f was written by Michal Zalewski <lcamtuf@coredump.cx>. This man page was originally written by William Stearns <wstearns@pobox.com>, then adopted for p0f v2 by Michal Zalewski, and p0f v3 by Pierre Chifflier. 💜 absolute legends, all of them.

---

and that's the whole thing, bestie!! 🎀 the footer just says P0F(1) — that's the source, version and date vibe for this one, so that's the sign-off. slay, go passively fingerprint some systems, and remember: no suspicious network traffic, no problem. periodt. 💅✨