Passive TCP fingerprint

Passive TCP fingerprint

  • Documentation
  • GitHub

›Documentation

Documentation

  • Overview
  • Quick Example
  • SYN and SYN+ACK Packets
  • MTU
  • Uptime
  • Http request and response

Uptime

Provides an estimate of how long the system has been running since its last boot.

Uptime Analyzed

.-[ 1.2.3.4/1524 -> 4.3.2.1/80 (uptime) ]-
|
| client = 1.2.3.4
| uptime = 0 days 11 hrs 16 min (modulo 198 days)
| raw_freq = 250.00 Hz
|
`----

Uptime Key Fields

  • client: The source IP and port initiating the connection.

  • uptime: This is the estimated time the system has been running since its last reboot.

  • raw_freq: Refers to the frequency of the system's TCP timestamp clock, which is usually derived from the host's kernel timer.

← MTU Http request and response →
  • Uptime Analyzed
  • Uptime Key Fields

Passive TCP Fingerprinting Based on p0f