P0f

优点

p0f被动式检测的特点使其在检测过程中不增加任何直接或间接的网络负载。它通过捕获数据包进行分析的方法确定远程主机的操作系统，远程主机不能检测到自己的数据包被捕获。

原理

p0f捕获数据包并进行分析，包括IPv4和IPv6头、TCP头、TCP握手以及应用层的数据。

用法

p0f没有图形界面，可以从命令行运行。

Usage: p0f [ ...options... ] [ 'filter rule' ]

Network interface options:

  -i iface  - listen on the specified network interface
  -r file   - read offline pcap data from a given file
  -p        - put the listening interface in promiscuous mode
  -L        - list all available interfaces

Operating mode and output settings:

  -f file   - read fingerprint database from 'file' (/etc/p0f/p0f.fp)
  -o file   - write information to the specified log file
  -s name   - answer to API queries at a named unix socket
  -u user   - switch to the specified unprivileged account and chroot
  -d        - fork into background (requires -o or -s)

Performance-related options:

  -S limit  - limit number of parallel API connections (20)
  -t c,h    - set connection / host cache age limits (30s,120m)
  -m c,h    - cap the number of active connections / hosts (1000,10000)

Optional filter expressions (man tcpdump) can be specified in the command
line to prevent p0f from looking at incidental network traffic.