Wireshark · Ethereal-dev: [Ethereal-dev] Integration of OS TCP/IP Stack Fingerprinting

["Tan ChaurLih" <chaurlih@xxxxxxxxxxx>]

Hi List,

   I wonder if anyone's interested in building in OS TCP/IP Stack 
Fingerprinting code into Ethereal?  The engine I am considering is available 
at   http://lcamtuf.coredump.cx/p0f.shtml   .  Though it hasn't been updated 
for a long time, the code has been integrated into OpenBSD's firewall.  So, 
how much interest is there among you guys to do this?

  The biggest use of this integration is the ability to spot suspicious 
activity (like linux boxes sending out Slammer Worm packets and having 
multiple OSes running off the same IP address / MAC address), which I 
believe makes it very useful and interesting for many of us.

  Any interested parties?

CL.

_________________________________________________________________
Find it on the web with MSN Search. http://search.msn.com.sg/