<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Matt Jonkman wrote:
<blockquote cite="mid:494C00EE.5020802@jonkmans.com" type="cite">
<pre wrap="">Decula in IRC had two great ideas. One was to use something like p0f to
do live OS fingerprinting.
That could be very useful for eliminating false positives and
identifying unusual behavior (ie a windows box running a telnet server, etc)
Adding this to the wiki, anyone have thoughts to add to that?
Matt
</pre>
</blockquote>
p0f can't tell the difference between a windows XP workstation and
windows 2000 server (last I remember).<br>
I had used it for 'zombie' detection in our anti-spam system, but the
incremental assistance wasn't worth the cpu (it took a little cpu.)<br>
<br>
<br>
<div class="moz-signature">-- <br>
Michael Scheidell, CTO<br>
Phone: 561-999-5000, x 1259<br>
<font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
Network Security Corporation
<style type="text/css">
<!--
.unnamed1 {
margin: 1em;
padding: 1px;
} -->
</style>
<ul class="unnamed1">
<li>Certified SNORT Integrator</li>
<li>King of Spam Filters, SC Magazine 2008</li>
<li>Information Security Award 2008, Info Security Products Guide</li>
<li>CRN Magazine Top 40 Emerging Security Vendors</li>
</ul>
</div>
<br>
<div id="disclaimer.secnap.com"><hr>
<p>This email has been scanned and certified safe by SpammerTrap®.
<br />For Information please see
<a href="http://www.secnap.com/products/spammertrap/">www.secnap.com/products/spammertrap/</a></p>
<hr></div>
<br>
</body>
</html>