Passive OS fingerprinting is based on information coming from a remote host
when it establishes a connection to our system. Captured packets contain
enough information to identify the operating system. In contrast to active
scanners such as nmap and QueSO, p0f does not send anything to the host
being identified.
For more information, refer to Lance Spitzner's old paper about passive OS
fingerprinting: http://old.honeynet.org/papers/finger/.
Use of this program requires read access to the packet filtering device,
typically /dev/bpf0. Granting such access allows the users who have it to
put your Ethernet device into promiscuous mode and sniff your network.
Running p0f with no options will cause it to analyze packets intended for
other hosts.
===> The following configuration options are available for p0f-3.09b_1:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
net-mgmt: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* @BABOLO <.@babolo.ru>
* Alex Samorukov, samm@freebsd.org
* Alexander Kriventsov <avk@vl.ru>
* Alexander Sulfrian <alexander@sulfrian.net>
* Alexander Y. Grigoryev <alexander.4mail@gmail.com>
* Alexandre Biancalana <ale@biancalanas.net>
* Alexandre Snarskii <snar@paranoia.ru>
* Alexandre Snarskii <snar@snar.spb.ru>
* Alexey Bobkov <mr.deadlystorm@gmail.com>
* Alexey Dokuchaev <danfe@FreeBSD.org>
* Alexey V. Degtyarev
(Only the first 15 lines of the commit message are shown above )
net-mgmt/p0f: add rc script
Added rc script to run p0f in daemon mode as as unprivileged user.
That is useful to provide access to p0f API via unix socket for
various clients (e.g. anti-spam filters like rspamd, haraka-plugin-p0f,
etc.).
PR: 240712
Submitted by: Alexander Moisseev <moiseev@mezonplus.ru>
- Restore link to Lance Spitzner's article (2002 Honeynet Project version)
- Remove nowadays defunct www.infoworld.com link (missed in r426160)
Submitted by: Royce Williams
- Reformat port description text for better readability and compactness
- Remove reference to Spitzner's paper which is no longer available
- Fix a typo (analyse -> analyze); update WWW entry to avoid redirect
net-mgmt/p0f: 3.08b -> 3.09b
- Fixed a likely only cosmetic bug with a one-byte overread of the pcap
packet buffer, which would cause an error under ASAN. Spotted by
Xavid Pretzer.
- Added a new signature for Chrome.
- Updated another signature for Chrome.
net-mgmt/p0f: 3.06b -> 3.07b, and change to freebsd maintainer email address
Bug fixes:
- Improvement to API handling to avoid FATAL() on short API reads & writes.
- Minor bug fix to IP parsing in one of the companion utilities.
Improvements:
- New signatures.
Approved by: jadawin (mentor)
According to the Porter's Handbook (5.12.2.3.) default options must be added to
OPTIONS_DEFINE. This policy has been implemented only recently that's why we
have many ports violating this policy.
This patch adds the default options specified in the Porter's Handbook to
OPTIONS_DEFINE where they are being used. Ports maintained by
gnome@FreeBSD.org, kde@FreeBSD.org and x11@FreeBSD.org have been excluded.
Approved by: portmgr (bapt)
- Update to 3.06b
While here:
- Trim Makefile header
- Convert to new options framework
- Remove LICENSE_FILES and extra installation of COPYING
since the full LGPL21 license is included in the ports tree
PR: ports/172394
Submitted by: Kurt Jaeger <fbsd-ports@opsec.eu> (maintainer)
Approved by: makc, avilla (mentors implicit)
Pass maintainer to submitter of previous PR. The email address in the PR
was incorrect, so I took it over until I could get confirmation on what
address to use.
PR: ports/166224
Submitted by: Kurt Jaeger <fbsd-ports@opsec.eu>
Feature safe: yes
Update to 3.03b.
Switch to using PLIST_FILES and PORTDOCS.
No longer require gmake.
Don't require bash (build.sh).
PR: ports/166224 (based upon)
Submitted by: Kurt Jaeger <fbsd-ports@opsec.eu>
Feature safe: yes
Reset maintainership to ports@ after ~4 months without any response to any
PR.
Thanks for contributing.
Since the acroread7 port is a somewhat important port for our users, I
will hand it over to emulation@ if no _active_ *committer* takes it
before the ports freeze.
While I'm here:
- fix a little nit in the csound port (I think the intention was to
create no backup file instead of creating one with a "-e" extension)
- set ARCH to i386 in the amd64 case for the acroread7 port. This
is a work-around to be able to install everything when a dependency
is not already installed (ARCH is read-only in sub-makes, so the
dependencies can't change it). This should be removed when the
dependencies are fixed or converted to use bsd.linux-rpm.mk. [1]
Not objected to by: portmgr (explicit: krion; silence: rest)
Maintainer timeout: ~4 months
Submitted by: Sangwoo Shim <sangwoos@gmail.com> [1]
PR: 87985 [1]
Readd changes which was lost in repocopy of this port from net to net-mgmt:
Makefile rev 1.15
Install the p0fa.fp and p0fr.fp files, needed when the -A and -R
options are used (new PORTREVISION).
PR: 62273
Submitted by: Radim Kolar
files/patch-p0f.c rev 1.3
On FreeBSD, the loopback interface is normally called lo0.
PR: 62358
Submitted by: Radim Kolar
files/patch-mtu.h rev 1.5
files/patch-p0f.c rev 1.1
more patches to add loopback support
PR: 62274
Submitted by: Radim Kolar
Reported by: Radim Kolar <hsn@netmag.cz>
Pointy hat (XL size) to: wollman
Say hello to the new "net-mgmt" category. There are probably more
ports that belong here than the ones I have identified and moved in
this, first, pass.
Approved in principle by: marcus
