# P0f

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/P0f
> Markdown URL: https://mediated.wiki/source/P0f.md
> Source: https://en.wikipedia.org/wiki/P0f
> Source revision: 1357224938
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**p0f** is a passive [TCP/IP stack fingerprinting](/source/TCP/IP_stack_fingerprinting) tool developed by [Michał Zalewski](/source/Micha%C5%82_Zalewski). It is used to identify characteristics of remote hosts by observing existing [network traffic](/source/Network_traffic), rather than by sending active probes to the target system.[3]

## Overview

p0f works by inspecting fields in captured [IP](/source/Internet_Protocol) and [TCP](/source/Transmission_Control_Protocol) packets. For TCP/IP traffic, it examines information such as the initial [TTL](/source/Time_to_live), [maximum segment size](/source/Maximum_segment_size), TCP option ordering, window size and other implementation-specific properties of network packets.[3] These values are compared with entries in a fingerprint database in order to infer the likely operating system or software that generated the traffic.[3]

Because p0f is passive, it does not send fingerprinting probes to the remote host. This distinguishes it from active scanning tools such as [Nmap](/source/Nmap), which can generate specially crafted packets for host discovery and operating-system detection.[4] Passive fingerprinting can be useful in environments where generating additional traffic is undesirable, unreliable or likely to trigger alarms.[3]

In addition to [operating system](/source/Operating_system) fingerprinting, p0f can report other network characteristics, including approximate distance, system uptime, link type and signs of [NAT](/source/Network_address_translation), [load balancing](/source/Load_balancing) or application-level proxying.[3] Version 3 also includes application-level fingerprinting support for [HTTP](/source/Hypertext_Transfer_Protocol) traffic.[3]

## History

An early version of p0f was announced on the [Bugtraq](/source/Bugtraq) mailing list in 2000 as a passive operating-system fingerprinting tool.[5] Version 3 was a major rewrite of the earlier codebase and introduced improved TCP fingerprinting, [IPv6](/source/IPv6) support, stateful traffic inspection, application-level fingerprinting modules and a redesigned local API.[3]

## Usage

p0f is normally run from the [command line](/source/Command-line_interface). It can listen on a live [network interface](/source/Network_interface_controller) or read packets from a saved [pcap](/source/Pcap) capture file.[3] The program can also run as a [daemon](/source/Daemon_(computing)) and write observations to a log file, or expose information through a local API socket for use by other programs.[3]

The signatures used by p0f are stored in a plain-text fingerprint database file, usually named p0f.fp.[3] Users can provide a different fingerprint file at [run time](/source/Run_time_(program_lifecycle_phase)), allowing signatures to be updated or modified without recompiling the program.[3]

## See also

- [Computer security](/source/Computer_security)
- [Network monitoring](/source/Network_monitoring)
- [Packet analyzer](/source/Packet_analyzer)
- [Port scanner](/source/Port_scanner)

## References

1. ["p0f"](https://formulae.brew.sh/formula/p0f). *Homebrew Formulae*. Retrieved 1 June 2026.

1. ["Contents of p0f-3.09b.tgz"](https://fossies.org/linux/privat/p0f-3.09b.tgz/). *Fossies*. 18 April 2016. Retrieved 1 June 2026.

1. Zalewski, Michał (2012). ["p0f v3: passive fingerprinter"](https://lcamtuf.coredump.cx/p0f3/README). *lcamtuf.coredump.cx*. Retrieved 1 June 2026.

1. Lyon, Gordon Fyodor (2009). ["Fingerprinting Methods Avoided by Nmap"](https://nmap.org/book/osdetect-other-methods.html). *Nmap Network Scanning*. Nmap Project. Retrieved 1 June 2026.

1. Zalewski, Michał (10 June 2000). ["p0f - passive os fingerprinting tool"](https://seclists.org/bugtraq/2000/Jun/141). Retrieved 1 June 2026.

## External links

- [Official website](https://lcamtuf.coredump.cx/p0f3/)

---
Adapted from the Wikipedia article [P0f](https://en.wikipedia.org/wiki/P0f) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/P0f?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.