gop0f

README

Gop0f - Client library for p0f passive fingerprinting

Installing

go get github.com/kalikaneko/gop0f

Using

Using the library in your service:

import (
  "github.com/kalikaneko/gop0f"
  "net"
)

p0fclient, err := gop0f.New("/var/run/p0f.socket")
if err != nil {
  panic(err)
}
resp, err := p0fclient.Query(net.ParseIP("127.0.0.1"))
if err != nil {
  panic(err)
}

Using the included cli tool:

$ p0f-cli -q 127.0.0.1

Further reading

Read more about p0f by Michal Zalewski

Documentation

Index

• Constants
• Variables
• type GoP0f
  • func New(sock string) (p0f *GoP0f, err error)
  • func (p0f *GoP0f) Close()
  • func (p0f *GoP0f) Query(addr net.IP) (info IPInfo, err error)
• type IPInfo
  • func NewInfo(r p0fResponse) (info IPInfo, err error)
• type OSMatchQuality

Constants

const (
	P0F_STATUS_BADQUERY = 0x00
	P0F_STATUS_OK       = 0x10
	P0F_STATUS_NOMATCH  = 0x20
	P0F_ADDR_IPV4       = 0x04
	P0F_ADDR_IPV6       = 0x06
	P0F_STR_MAX         = 31
	P0F_MATCH_FUZZY     = 0x01
	P0F_MATCH_GENERIC   = 0x02
)

Variables

var (
	P0F_QUERY_MAGIC = []byte{0x01, 0x46, 0x30, 0x50} // 0x50304601
	P0F_RESP_MAGIC  = []byte{0x02, 0x46, 0x30, 0x50} //0x50304602
)

Types

type GoP0f

type GoP0f struct {
	// contains filtered or unexported fields
}

func New

func New(sock string) (p0f *GoP0f, err error)

func (*GoP0f) Close

func (p0f *GoP0f) Close()

func (*GoP0f) Query

func (p0f *GoP0f) Query(addr net.IP) (info IPInfo, err error)

type IPInfo

type IPInfo struct {
	OsMatchQ   OSMatchQuality // Match quality
	BadSw      int            // Host is lying about U-A / Server
	Distance   uint16         // System distance
	OsName     string         // Name of detected OS
	OsFlavor   string         // Flavor of detected OS
	HttpName   string         // Name of detected HTTP app
	HttpFlavor string         // Flavor of detected HTTP app
	LinkType   string         // Link type
	Language   string         // Language
}

func NewInfo

func NewInfo(r p0fResponse) (info IPInfo, err error)

type OSMatchQuality

type OSMatchQuality int

const (
	Normal OSMatchQuality = 0 + iota
	Fuzzy
	Signature
	FuzzySignature
)