()
return result
This function returns a dictionary of signatures indexed by p0f
db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.

You need to have your firewall at least accepting the TCP packets
from/to a high port (30000 <= x <= 40000) on your loopback interface.

Please note that the generated signatures come from the loopback
interface and may (are likely to) be different than those generated on
"normal" interfaces.
This function returns a dictionary of signatures indexed by p0f
db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.
This function returns a dictionary of signatures indexed by p0f db ( e . g . p0f_kdb p0fa_kdb ... ) for the local TCP / IP stack .
def p0f_getlocalsigs():
    """This function returns a dictionary of signatures indexed by p0f
db (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.

You need to have your firewall at least accepting the TCP packets
from/to a high port (30000 <= x <= 40000) on your loopback interface.

Please note that the generated signatures come from the loopback
interface and may (are likely to) be different than those generated on
"normal" interfaces."""
    pid = os.fork()
    port = random.randint(30000, 40000)
    if pid > 0:
        # parent: sniff
        result = {}
        def addresult(res):
            # TODO: wildcard window size in some cases? and maybe some
            # other values?
            if res[0] not in result:
                result[res[0]] = [res[1]]
            else:
                if res[1] not in result[res[0]]:
                    result[res[0]].append(res[1])
        # XXX could we try with a "normal" interface using other hosts
        iface = conf.route.route('127.0.0.1')[0]
        # each packet is seen twice: S + RA, S + SA + A + FA + A
        # XXX are the packets also seen twice on non Linux systems ?
        count=14
        pl = sniff(iface=iface, filter='tcp and port ' + str(port), count = count, timeout=3)
        map(addresult, map(packet2p0f, pl))
        os.waitpid(pid,0)
    elif pid < 0:
        log_runtime.error("fork error")
    else:
        # child: send
        # XXX erk
        time.sleep(1)
        s1 = socket.socket(socket.AF_INET, type = socket.SOCK_STREAM)
        # S & RA
        try:
            s1.connect(('127.0.0.1', port))
        except socket.error:
            pass
        # S, SA, A, FA, A
        s1.bind(('127.0.0.1', port))
        s1.connect(('127.0.0.1', port))
        # howto: get an RST w/o ACK packet
        s1.close()
        os._exit(0)
    return result
def p0f_getlocalsigs ( ) : pid = os . fork ( ) port = random . randint ( 30000 , 40000 ) if pid > 0 : # parent: sniff result = { } def addresult ( res ) : # TODO: wildcard window size in some cases? and maybe some # other values? if res [ 0 ] not in result : result [ res [ 0 ] ] = [ res [ 1 ] ] else : if res [ 1 ] not in result [ res [ 0 ] ] : result [ res [ 0 ] ] . append ( res [ 1 ] ) # XXX could we try with a "normal" interface using other hosts iface = conf . route . route ( '127.0.0.1' ) [ 0 ] # each packet is seen twice: S + RA, S + SA + A + FA + A # XXX are the packets also seen twice on non Linux systems ? count = 14 pl = sniff ( iface = iface , filter = 'tcp and port ' + str ( port ) , count = count , timeout = 3 ) map ( addresult , map ( packet2p0f , pl ) ) os . waitpid ( pid , 0 ) elif pid < 0 : log_runtime . error ( "fork error" ) else : # child: send # XXX erk time . sleep ( 1 ) s1 = socket . socket ( socket . AF_INET , type = socket . SOCK_STREAM ) # S & RA try : s1 . connect ( ( '127.0.0.1' , port ) ) except socket . error : pass # S, SA, A, FA, A s1 . bind ( ( '127.0.0.1' , port ) ) s1 . connect ( ( '127.0.0.1' , port ) ) # howto: get an RST w/o ACK packet s1 . close ( ) os . _exit ( 0 ) return result