# OS Fingerprinting

**URL:** <https://community.zeek.org/t/os-fingerprinting/3876>\
**Category:** Zeek\
**Created:** [October 20, 2015, 11:00am UTC](https://community.zeek.org/t/os-fingerprinting/3876 "2015-10-20T11:00:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thomas\_Tan](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@Thomas\_Tan](https://community.zeek.org/u/Thomas_Tan)\
**Post date:** [October 20, 2015, 11:00am UTC](https://community.zeek.org/t/os-fingerprinting/3876/1 "2015-10-20T11:00:48Z")

</div>

Hi All,

I am writing an extension of Operating System Fingerprinting for Bro, and want to use the OS signatures generated (NOT the p0f fingerprint file) by Bro in my component for classification.

According to my best knowledge, the following two events can help collect almost all the fields of an OS signature.

1. event tcp\_option (c:connection, is\_orig:bool, opt:count, optlen:count)
2. event connection\_SYN\_packet(c:connection, pkt:SYN\_packet)

However, they are two separate events, and extra efforts is required to construct an accurate OS signature.

Just wondering if there is an event that can do it at one go?

Thank you in advance.

Best regards,

Thomas

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/os-fingerprinting/3876/2 "2022-05-06T15:43:10Z")

</div>