# OS Fingerprint on Zeek logs - options and setup

**URL:** <https://community.zeek.org/t/os-fingerprint-on-zeek-logs-options-and-setup/7401>\
**Category:** Zeek\
**Tags:** fingerprinting\
**Created:** [June 27, 2024, 11:35am UTC](https://community.zeek.org/t/os-fingerprint-on-zeek-logs-options-and-setup/7401 "2024-06-27T11:35:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yyxxzm](https://avatars.discourse-cdn.com/v4/letter/y/85f322/32.png) [@yyxxzm](https://community.zeek.org/u/yyxxzm)\
**Post date:** [June 27, 2024, 11:35am UTC](https://community.zeek.org/t/os-fingerprint-on-zeek-logs-options-and-setup/7401/1 "2024-06-27T11:35:35Z")

</div>

Hi,  
I was wondering if there’s a way to do OS fingerprinting on Zeek logs. I saw that p0f is no longer used. I tried to find some packages but I can’t find none. I was looking on how to do it manually but I can’t find where TTL and Windows Size of TCP packets are logged. Anyone can help me? Thanks!

---

<div class="post-metadata">

**Author:** ![SniffaWes](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@SniffaWes](https://community.zeek.org/u/SniffaWes)\
**Post date:** [July 2, 2024, 1:23pm UTC](https://community.zeek.org/t/os-fingerprint-on-zeek-logs-options-and-setup/7401/2 "2024-07-02T13:23:22Z")

</div>

Hi,  
I have recently been using the JA4T fingerprints to do just what you are suggesting, I have had some success in identifying OS in that way.  
See Github for more info of how to implement it in Zeek - [ja4/zeek at main · FoxIO-LLC/ja4 · GitHub](https://github.com/FoxIO-LLC/ja4/tree/main/zeek)  
Also check out [https://www.sniffa-nss.com](https://www.sniffa-nss.com) to see how they are implementing JA4 too.  
Cheers.