# OS Fingerprinting

**URL:** <https://community.zeek.org/t/os-fingerprinting/6450>\
**Category:** Zeek\
**Created:** [February 16, 2022, 8:22pm UTC](https://community.zeek.org/t/os-fingerprinting/6450 "2022-02-16T20:22:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Charles\_Dillard](https://avatars.discourse-cdn.com/v4/letter/c/7cd45c/32.png) [@Charles\_Dillard](https://community.zeek.org/u/Charles_Dillard)\
**Post date:** [February 16, 2022, 8:22pm UTC](https://community.zeek.org/t/os-fingerprinting/6450/1 "2022-02-16T20:22:11Z")

</div>

Hello, I was asked by a supervisor if we at my company were logging OS Fingerprinting.?

Checked logs for various “operating”, “system”, “os” “windows”, “ATTACK” without luck.

I see there is this policy:

/opt/bro/share/bro/policy/frameworks/signatures/detect-windows-shells.sig

Can you help us answer the question on whether OS Fingerprinting is being logged and which log would I look in? Also, what would I look for?

We are running the following:

zeek version 4.0.3

bro version 2.5

Also, if not present, how would we enable? Looking to see ANY os hitting our network.

---

<div class="post-metadata">

**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\
**Post date:** [February 17, 2022, 8:19pm UTC](https://community.zeek.org/t/os-fingerprinting/6450/2 "2022-02-17T20:19:29Z")

</div>

Hi Charles,

> Can you help us answer the question on whether OS Fingerprinting is being logged and which log would I look in? Also, what would I look for?

The closest Zeek has to offer for this is its software framework, which logs software version information it can discern in the traffic. Look for software.log in your resulting set of logs. The value of that framework depends on the version detectors hooked into it, and we unfortunately don't have a whole lot of those. Consider this example:

[https://docs.zeek.org/en/master/scripts/policy/frameworks/software/windows-version-detection.zeek.html](https://docs.zeek.org/en/master/scripts/policy/frameworks/software/windows-version-detection.zeek.html)

The script you flagged is more of a one-off, but you are correct in that it will detect these specific shells (via the signature.log, as this detection is driven by signatures only).

Also take a look at the Zeek package repository, for example via these queries:

[https://packages.zeek.org/packages?q=fingerprint](https://packages.zeek.org/packages?q=fingerprint)  
[https://packages.zeek.org/packages?q=software](https://packages.zeek.org/packages?q=software)

Best,  
Christian

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/os-fingerprinting/6450/3 "2022-05-06T15:47:50Z")

</div>