Hi,
I was wondering if there’s a way to do OS fingerprinting on Zeek logs. I saw that p0f is no longer used. I tried to find some packages but I can’t find none. I was looking on how to do it manually but I can’t find where TTL and Windows Size of TCP packets are logged. Anyone can help me? Thanks!
Hi,
I have recently been using the JA4T fingerprints to do just what you are suggesting, I have had some success in identifying OS in that way.
See Github for more info of how to implement it in Zeek - ja4/zeek at main · FoxIO-LLC/ja4 · GitHub
Also check out https://www.sniffa-nss.com to see how they are implementing JA4 too.
Cheers.