# Any plans to use p0f V3 signature?

**URL:** <https://community.zeek.org/t/any-plans-to-use-p0f-v3-signature/3830>\
**Category:** Zeek\
**Created:** [September 16, 2015, 5:51am UTC](https://community.zeek.org/t/any-plans-to-use-p0f-v3-signature/3830 "2015-09-16T05:51:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [September 16, 2015, 5:51am UTC](https://community.zeek.org/t/any-plans-to-use-p0f-v3-signature/3830/1 "2015-09-16T05:51:00Z")

</div>

Hi

I have been using p0f -v1.8.3 [fingerprints](https://tools.netsa.cert.org/confluence/display/tt/p0f+fingerprints) but having some issue  
bro is printing out couple of OS from same IP

module osfound;

redef generate\_OS\_version\_event: set[subnet]={[172.16.0.0/16](http://172.16.0.0/16), [192.168.0.0/16](http://192.168.0.0/16)};  
export {

redef enum Log::ID += { LOG };

type Info: record {

ts: time &log;  
uid: string &log;  
srcip: addr &log;  
ostype: string &log &optional;  
};  
}

event bro\_init()

{  
Log::create\_stream(osfound::LOG, [$columns = Info]);  
}

event OS\_version\_found(c:connection, host:addr, OS:OS\_version)  
{  
local log: Info;  
log = [$ts = c$start\_time, $uid = c$uid, $srcip = host, $ostype = fmt("%s",OS)];

Log::write(osfound::LOG, log);

}

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [September 18, 2015, 5:25pm UTC](https://community.zeek.org/t/any-plans-to-use-p0f-v3-signature/3830/2 "2015-09-18T17:25:16Z")

</div>

> Hi
> 
> I have been using p0f -v1.8.3 fingerprints  
> \<[https://tools.netsa.cert.org/confluence/display/tt/p0f+fingerprints&gt](https://tools.netsa.cert.org/confluence/display/tt/p0f+fingerprints&gt); but  
> having some issue  
> bro is printing out couple of OS from same IP

These signatures are quite out of date by now - so I guess it is not  
really to be too unexpected that they do not really give you good results  
anymore.

That being said - just to ask the obvious question - there is no chance  
someone is using virtual machines or a NAT gateway there?

> So I test p0f - v3, so far I did not have this issue.( just p0f -i eth1 -a  
> os.log)
> 
> am I having this issue because of my bro script ?

Probably no...

> if not do you have any plans to use p0f - v3 (or fingerprints  
> \<[https://tools.netsa.cert.org/confluence/display/tt/p0f+fingerprints&gt;\](https://tools.netsa.cert.org/confluence/display/tt/p0f+fingerprints&gt;%5C))?

p0f v3 is quite different from the earlier versions and uses information  
from e.g. HTTP headers for its operating system determination. One could  
probably try to re-implement something similar using Bro scripts -- there  
already are scripts that track information about hosts (like software.log)  
that could be used towards this end.

As far as I am aware, no one currently has plans to add p0f v3 support to  
Bro.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/any-plans-to-use-p0f-v3-signature/3830/3 "2022-05-06T15:43:05Z")

</div>