# OS fingerprinting Status

**URL:** <https://community.zeek.org/t/os-fingerprinting-status/5818>\
**Category:** Zeek\
**Created:** [August 27, 2019, 8:33am UTC](https://community.zeek.org/t/os-fingerprinting-status/5818 "2019-08-27T08:33:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Federico\_Foschini](https://avatars.discourse-cdn.com/v4/letter/f/b9bd4f/32.png) [@Federico\_Foschini](https://community.zeek.org/u/Federico_Foschini)\
**Post date:** [August 27, 2019, 8:33am UTC](https://community.zeek.org/t/os-fingerprinting-status/5818/1 "2019-08-27T08:33:18Z")

</div>

Hello,  
Is there a way to fingerprinting operating systems in zeek?  
I have done some testing using **OS\_version\_found** event

[https://docs.zeek.org/en/stable/scripts/base/bif/event.bif.bro.html#id-OS\_version\_found](https://docs.zeek.org/en/stable/scripts/base/bif/event.bif.bro.html#id-OS_version_found)  
and by modify this old script:  
[https://github.com/ewust/telex/blob/master/telex-station/station/bro-1.5.1/policy/OS-fingerprint.bro](https://github.com/ewust/telex/blob/master/telex-station/station/bro-1.5.1/policy/OS-fingerprint.bro)

But without much success.

I stumpled upon the (WIP) release notes from Zeek 3.1.0 and read the following:

- Removed p0f (passive OS fingerprinting) support. The version of  
p0f shipped with zeek was ancient, probably did not give  
any reliable support anymore and did not offer a clear  
upgrade path. The `OS_version_found` event as well as the  
`generate_OS_version_event` configuration option were removed.

So I’m assuming my apprach it will be a failure.  
Is there another way to get OS information? Are there some zeek scripts that offer this functionality?

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)\
**Post date:** [August 27, 2019, 2:01pm UTC](https://community.zeek.org/t/os-fingerprinting-status/5818/2 "2019-08-27T14:01:36Z")

</div>

Hi,

Yes, the p0f method has been retired since it was unreliable and, frankly, wasn’t taking advantage of Zeek’s feature set.

There are some scripts that offer similar functionality, but which should be much more reliable, for example:

[https://github.com/zeek/zeek/blob/master/scripts/policy/frameworks/software/windows-version-detection.zeek](https://github.com/zeek/zeek/blob/master/scripts/policy/frameworks/software/windows-version-detection.zeek)  
[https://github.com/fatemabw/bro-scripts/blob/master/iPhone-detection.bro](https://github.com/fatemabw/bro-scripts/blob/master/iPhone-detection.bro)  
[https://github.com/fatemabw/bro-scripts/blob/master/Mac-version-detection.bro](https://github.com/fatemabw/bro-scripts/blob/master/Mac-version-detection.bro)

–Vlad

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/os-fingerprinting-status/5818/3 "2022-05-06T15:46:43Z")

</div>