from the README:
Passive OS fingerprinting is based on information coming from a remote host
when it establishes a connection to our system. Captured packets contain
enough information to identify the operating system. In contrast to active
scanners such as nmap and QueSO, p0f does not send anything to the host being
identified.
For more information, read Spitzner's text at:
http://www.enteract.com/~lspitz/finger.html .
from the maintainer:
Use of this program requires read access to the packet filtering
device, typically /dev/bpf0. Granting such access allows the users
who have it to put your Ethernet device into promiscuous mode and
sniff your network. See
http://www.infoworld.com/articles/op/xml/00/05/29/000529opswatch.xml
if you do not understand how this can be harmful. Running p0f with
no options will cause it to analyse packets intended for other
hosts.
WWW: http://www.stearns.org/p0f/
Say hello to the new "net-mgmt" category. There are probably more
ports that belong here than the ones I have identified and moved in
this, first, pass.
Approved in principle by: marcus
Update to 1.8.2. Remove patches to README and p0f.c because they have been
accepted upstream. Install new CREDITS and ChangeLog with documentation.
Install new p0frep script. Use DOCSDIR macro.
Update to "1.8 final release". Change master site. Add new home page.
Install new man page. Be verbose. Add patch to fix new -o option. Update
patch to README (the old one was integrated upstream). The new patches have
been sent to William Stearns.
