# p0f v3 signature definitions

**URL:** <https://community.zeek.org/t/p0f-v3-signature-definitions/2547>\
**Category:** Zeek\
**Created:** [February 6, 2013, 9:34pm UTC](https://community.zeek.org/t/p0f-v3-signature-definitions/2547 "2013-02-06T21:34:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_Swaro](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@James\_Swaro](https://community.zeek.org/u/James_Swaro)\
**Post date:** [February 6, 2013, 9:34pm UTC](https://community.zeek.org/t/p0f-v3-signature-definitions/2547/1 "2013-02-06T21:34:28Z")

</div>

Quick question about OS fingerprinting:

Will the OS fingerprinting code in bro be updated to use the new fingerprint definitions given in the latest version of p0f(3.06b)?

Thanks,

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [February 6, 2013, 10:01pm UTC](https://community.zeek.org/t/p0f-v3-signature-definitions/2547/2 "2013-02-06T22:01:47Z")

</div>

It depends on what you mean by that. 🙂

I tend to upgrade the signatures when there are new releases, but we only support the original SYN packet mechanism (and not the newer SYN/ACK mechanism) so not all of the signatures will do anything directly. We do certainly accept patches if you feel up for updating the p0f code!

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu2](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@Vlad\_Grigorescu2](https://community.zeek.org/u/Vlad_Grigorescu2)\
**Post date:** [February 6, 2013, 10:12pm UTC](https://community.zeek.org/t/p0f-v3-signature-definitions/2547/3 "2013-02-06T22:12:01Z")

</div>

I tried dropping the v3 sigs into Bro's existing p0f mechanism, and it was \*really\* unhappy - I believe it would just quickly segfault. I even tried only importing the SYN-only sigs. I don't think the new format is backwards compatible with the old format, and would need some work to support.

&nbsp;&nbsp;--Vlad

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/p0f-v3-signature-definitions/2547/4 "2022-05-06T15:40:45Z")

</div>


