Tutorial: OS fingerprinting and routing distance

Description

Certain fields in the IP and TCP header give an indication about the type of operating system. Nevertheless, these fields, e.g. TTL, initial window size, tcp options, can be obfuscated by a NAT or a savvy user. In the good old times with linux, solaris, hp, windows NT/XP and all these wonderful diverse OS this approach worked well. Even the user agent in the http protocol told you right away what kind of OS and application the machine was running. Nevertheless, it is still useful, but to be treated with care. T2 owns three plugins:

  • tp0f
  • p0f depending on sslDecode
  • httpSniffer, userAgent column
  • tcpOption > host clk frequency

The first two depend on the rules of the well known p0f OS fingerprinting tool version 3.09b. While the third uses the userAgent filed in http traffic, which is nowadays rather rare, Bummer. The last one uses information from tcpTimestamp options and the pcap timestamps. It is implemented in tcpFlags.

Preparation

Before we start we need to prepare T2. If you did not complete the tutorials before just follow the procedure described below.

First I recommend to set T2 into a pristine state by removing all unnecessary or older plugins from the plugin folder ~/.tranalyzer/plugins and compile the standard plugins. Just as a precaution if you have some old plugins or files there. If you like to keep them, please copy them away.

$ t2build -e
Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? y
Plugin folder emptied
$ t2build tranalyzer2 basicFlow tcpStates tp0f txtSink
...
BUILD SUCCESSFUL

$

Compiling the basicFlow took now a bit longer, because the subnet file for geolocation had to rebuilt. Moreover the ‘-e’ option also removes all subnet files.

$ mkdir ~/data
$ mkdir ~/results
$ cd data

Download the sample pcap if did not do it already: faf-exercise.pcap. Now you’re all set.

tp0f config

tp0f uses the p0f rules in the onFlowGenerated function, so the first packet in a A/B flow, which contains all the valuable info, such as options, syn,syn-ack sequence, etc

Let’s have a look into the tp0f directory.

$ ls
AUTHORS  autogen.sh  ChangeLog  configure.ac  COPYING  doc  Makefile.am  NEWS  p0fdoc.txt  p0f.fp  README  src  t2plconf  tests  tp0fL34conv  tp0fL34.txt  ttl.txt  ver.txt  win.txt
$

If the p0f rules don’t match, tp0f has its own heuristics, which tries to give an crude opinion about the type of OS. For that the files ttl.txt, ver.txt, win.txt are necessary. The file p0f.fp is the p0f db being used by the p0f tool. The script tp0fL34conv converts pof.fp to tp0fL34.txt. This happens automatically when t2build is invoked and no tp0fL34.txt is found under ./tranalyzer/plugins . We added the documentation of the p0f tool: p0fdoc.txt so that you can write your own p0f file.

Now look at the configuration options in tp0f.h in the src directory

TP0FRULES controls whether the p0f rules are being used or only t2 simple heuristics OS guessing. TP0FHSH controls the query of the p0f file. If enabled duplicate queries are avoided, thus increasing the speed of the plugin execution. For AI labeling tasks TP0FRC has to be enabled to produce uniq class numbers.

If you want to use your own rule file, change TP0FL34FILE and recompile. Note, that you have to use the same format as in the tp0fL34.txt file as shown below.

$ tcol tp0fL34.txt
#num  clst  ipv   ip    tcp   qopt    ittl  olen  mss    wsize_ws     num_tcpopt  tcpopt                                                                 pldl  Nclass  Nprog  Nver  class  prog         ver                                       vOS        comment
1     0x0a  0x00  0x40  0x02  0x0040  64    0     0      20,10        5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      22    unix   Linux        3.11 and newer                                        Linux
2     0x0a  0x00  0x40  0x02  0x0040  64    0     0      20,7         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      22    unix   Linux        3.11 and newer                                        Linux
3     0x0a  0x00  0x40  0x02  0x0040  64    0     0      10,4         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      23    unix   Linux        3.1-3.10                                              Linux
4     0x0a  0x00  0x40  0x02  0x0040  64    0     0      10,5         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      23    unix   Linux        3.1-3.10                                              Linux
5     0x0a  0x00  0x40  0x02  0x0040  64    0     0      10,6         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      23    unix   Linux        3.1-3.10                                              Linux
6     0x0a  0x00  0x40  0x02  0x0040  64    0     0      10,7         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      23    unix   Linux        3.1-3.10                                              Linux
7     0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,6          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      19    unix   Linux        2.6.x                                                 so not I'm not flagging these signatures in a special way.
8     0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,7          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      19    unix   Linux        2.6.x                                                 so not I'm not flagging these signatures in a special way.
9     0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,8          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      19    unix   Linux        2.6.x                                                 so not I'm not flagging these signatures in a special way.
10    0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,0          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      16    unix   Linux        2.4.x                                                 so not I'm not flagging these signatures in a special way.
11    0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,1          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      16    unix   Linux        2.4.x                                                 so not I'm not flagging these signatures in a special way.
12    0x0a  0x00  0x40  0x02  0x0040  64    0     0      4,2          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      16    unix   Linux        2.4.x                                                 so not I'm not flagging these signatures in a special way.
13    0x0a  0x00  0x40  0x02  0x0040  64    0     0      11,0         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      10    unix   Linux        2.2.x                                                 No real traffic seen for 2.2 & 2.0, signatures extrapolated from p0f2 data:
14    0x0a  0x00  0x40  0x02  0x0040  64    0     0      20,0         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      10    unix   Linux        2.2.x                                                 No real traffic seen for 2.2 & 2.0, signatures extrapolated from p0f2 data:
15    0x0a  0x00  0x40  0x02  0x0040  64    0     0      22,0         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      10    unix   Linux        2.2.x                                                 No real traffic seen for 2.2 & 2.0, signatures extrapolated from p0f2 data:
16    0x0a  0x00  0x00  0x02  0x0000  64    0     0      12,0         1           0x02                                                                   0     2       2      9     unix   Linux        2.0                                                   No real traffic seen for 2.2 & 2.0, signatures extrapolated from p0f2 data:
17    0x08  0x00  0x00  0x02  0x0000  64    0     0      16384,0      1           0x02                                                                   0     2       2      9     unix   Linux        2.0                                                   No real traffic seen for 2.2 & 2.0, signatures extrapolated from p0f2 data:
18    0x02  0x00  0x40  0x02  0x0040  64    0     16396  524672,4     5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      26    unix   Linux        3.x (loopback)                                        Just to keep people testing locally happy (IPv4 & IPv6):
19    0x02  0x00  0x40  0x02  0x0040  64    0     16376  524032,4     5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      26    unix   Linux        3.x (loopback)                                        Just to keep people testing locally happy (IPv4 & IPv6):
20    0x02  0x00  0x40  0x02  0x0040  64    0     16396  131168,2     5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      21    unix   Linux        2.6.x (loopback)                                      Just to keep people testing locally happy (IPv4 & IPv6):
21    0x02  0x00  0x40  0x02  0x0040  64    0     16376  131008,2     5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      21    unix   Linux        2.6.x (loopback)                                      Just to keep people testing locally happy (IPv4 & IPv6):
22    0x02  0x00  0x40  0x02  0x0040  64    0     16396  32792,0      5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      18    unix   Linux        2.4.x (loopback)                                      Just to keep people testing locally happy (IPv4 & IPv6):
23    0x02  0x00  0x40  0x02  0x0040  64    0     3884   31072,0      5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      14    unix   Linux        2.2.x (loopback)                                      Just to keep people testing locally happy (IPv4 & IPv6):
24    0x02  0x04  0x00  0x02  0x0000  64    0     1430   366080,6     5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      20    unix   Linux        2.6.x (Google crawler)                                Various distinctive flavors of Linux:
25    0x0a  0x00  0x40  0x02  0x0040  64    0     0      44,1         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      39    unix   Linux        (Android)                                             Various distinctive flavors of Linux:
26    0x0a  0x00  0x40  0x02  0x0040  64    0     0      44,3         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      39    unix   Linux        (Android)                                             Various distinctive flavors of Linux:
27    0x1a  0x00  0x40  0x02  0x0040  64    0     0      10,0         5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      25    unix   Linux        3.x                                                   Various distinctive flavors of Linux:
28    0x1a  0x00  0x40  0x02  0x0040  64    0     0      4,0          5           0x02,0x04,0x08,0x01,0x03                                               0     2       2      17    unix   Linux        2.4.x-2.6.x                                           Various distinctive flavors of Linux:
...
$

As the p0f rules are not supported anymore, in the future a new p0f file might be available again. Then you may use the script tp0fL34conv to produce a new tp0f rule file. Or you generate your own rules during your research work. Then, please contact us, so that we can integrate your rules in the older p0f rule set.

tp0f default config

Invoke T2 with the pcap in default mode and store it in your results folder.

$ t2 -r ~/data/faf-exercise.pcap -w ~/results/
================================================================================
Tranalyzer 0.8.6 (Anteater), Tarantula. PID: 5734
================================================================================
[INF] Creating flows for L2, IPv4, IPv6
Active plugins:
    01: basicFlow, 0.8.6
    02: tp0f, 0.8.6
    03: tcpStates, 0.8.6
    04: txtSink, 0.8.6
[INF] basicFlow: IPv4 Ver: 3, Rev: 01072019, Range Mode: 0, subnet ranges loaded: 312747 (312.75 K)
[INF] basicFlow: IPv6 Ver: 3, Rev: 01072019, Range Mode: 0, subnet ranges loaded: 21494 (21.49 K)
[INF] tp0f: 192 rules loaded
Processing file: /home/wurst/data/faf-exercise.pcap
Link layer type: Ethernet [EN10MB/1]
Dump start: 1258544215.037210 sec (Wed 18 Nov 2009 11:36:55 GMT)
Dump stop : 1258594491.683288 sec (Thu 19 Nov 2009 01:34:51 GMT)
Total dump duration: 50276.646078 sec (13h 57m 56s)
Finished processing. Elapsed time: 0.004496 sec
Finished unloading flow memory. Time: 0.004516 sec
Percentage completed: 100.00%
Number of processed packets: 5902 (5.90 K)
Number of processed bytes: 4993414 (4.99 M)
Number of raw bytes: 4993414 (4.99 M)
Number of pcap bytes: 5087870 (5.09 M)
Number of IPv4 packets: 5902 (5.90 K) [100.00%]
Number of A packets: 1986 (1.99 K) [33.65%]
Number of B packets: 3916 (3.92 K) [66.35%]
Number of A bytes: 209315 (209.31 K) [4.19%]
Number of B bytes: 4784099 (4.78 M) [95.81%]
Average A packet load: 105.40
Average B packet load: 1221.68 (1.22 K)
--------------------------------------------------------------------------------
tp0f: Number of p0f rule matches: 37 [51.39%]
tcpStates: Aggregated anomaly flags: 0x4a
--------------------------------------------------------------------------------
Headers count: min: 3, max: 3, average: 3.00
Number of TCP packets: 5902 (5.90 K) [100.00%]
Number of TCP bytes: 4993414 (4.99 M) [100.00%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 72
Number of processed A flows: 36 [50.00%]
Number of processed B flows: 36 [50.00%]
Number of request     flows: 36 [50.00%]
Number of reply       flows: 36 [50.00%]
Total   A/B    flow asymmetry: 0.00
Total req/rply flow asymmetry: 0.00
Number of processed   packets/flows: 81.97
Number of processed A packets/flows: 55.17
Number of processed B packets/flows: 108.78
Number of processed total packets/s: 0.12
Number of processed A+B packets/s: 0.12
Number of processed A   packets/s: 0.04
Number of processed   B packets/s: 0.08
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 0.00
Average full raw bandwidth: 795 b/s
Average full bandwidth : 792 b/s
Max number of flows in memory: 18 [0.01%]
Memory usage: 0.06 GB [0.09%]
Aggregate flow status: 0x0000000000004000
[INF] IPv4
$

In the plugin summary of the end report 51% of the matches with the tp0f rules. Open the flow file in your results folder.

For each flow a status, the srcIP routing distance the OS short and the full name, version is listed. The routing distance is generated from the TTL of the src address, it denotes the amount of hops between the src and dst host. A good feature to assess the validity of IPs, etc.

$ tcol ~/results/faf-exercise_flows.txt
%dir  flowInd  flowStat            timeFirst          timeLast           duration    numHdrDesc  numHdrs  hdrDesc       srcMac             dstMac             ethType  ethVlanID  srcIP           srcIPCC  srcIPWho                       srcPort  dstIP           dstIPCC  dstIPWho                       dstPort  l4Proto  tp0fStat  tp0fDis  tp0fClName  tp0fPrName  tp0fVerName  tcpStates
A     1        0x0000000000004000  1258544215.037210  1258544215.372742  0.335532    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1258     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x01      0        win         Windows     XP           0x00
B     1        0x0000000000004001  1258544215.202900  1258544215.537951  0.335051    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1258     6        0x00      17       unix        Solaris     unknown      0x00
A     2        0x0000000000004000  1258544216.385370  1258544216.723144  0.337774    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1259     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        win         Windows     XP           0x00
B     2        0x0000000000004001  1258544216.551313  1258544216.888595  0.337282    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1259     6        0x00      17       unix        Solaris     unknown      0x00
A     3        0x0000000000004000  1258544216.908284  1258544217.008468  0.100184    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1260     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x00
B     3        0x0000000000004001  1258544216.915576  1258544217.008019  0.092443    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1260     6        0x00      7        unix        Linux       unknown      0x00
A     4        0x0000000000004000  1258544217.003718  1258544217.348506  0.344788    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1261     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        win         Windows     XP           0x00
B     4        0x0000000000004001  1258544217.169421  1258544217.513942  0.344521    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1261     6        0x00      17       unix        Solaris     unknown      0x00
A     5        0x0000000000004000  1258544217.349751  1258544217.413719  0.063968    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1262     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x00
B     5        0x0000000000004001  1258544217.357036  1258544217.413505  0.056469    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1262     6        0x00      7        unix        Linux       unknown      0x00
A     6        0x0000000000004000  1258544217.408963  1258544217.754495  0.345532    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1263     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        win         Windows     XP           0x00
B     6        0x0000000000004001  1258544217.574652  1258544217.919686  0.345034    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1263     6        0x00      17       unix        Solaris     unknown      0x00
A     7        0x0000000000004000  1258544217.755746  1258544217.791475  0.035729    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1264     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x00
B     7        0x0000000000004001  1258544217.763049  1258544217.791016  0.027967    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1264     6        0x00      7        unix        Linux       unknown      0x00
A     8        0x0000000000004000  1258544217.786474  1258544218.129260  0.342786    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1265     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        win         Windows     XP           0x00
B     8        0x0000000000004001  1258544217.952162  1258544218.294696  0.342534    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1265     6        0x00      17       unix        Solaris     unknown      0x00
A     9        0x0000000000004000  1258544218.130258  1258544218.166240  0.035982    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1266     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x00
B     9        0x0000000000004001  1258544218.137543  1258544218.165782  0.028239    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1266     6        0x00      7        unix        Linux       unknown      0x00
A     11       0x0000000000004000  1258562478.204828  1258562509.633367  31.428539   1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1384     63.245.221.11   us       "Mozilla Corporation"          80       6        0x41      0        win         Windows     XP           0x00
B     11       0x0000000000004001  1258562478.266384  1258562509.653978  31.387594   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              63.245.221.11   us       "Mozilla Corporation"          80       192.168.1.104   09       "Private network"              1384     6        0x00      12       unix        Linux       unknown      0x00
A     10       0x0000000000004000  1258562467.749142  1258562509.633370  41.884228   1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1379     63.245.221.11   us       "Mozilla Corporation"          80       6        0x41      0        win         Windows     XP           0x00
B     10       0x0000000000004001  1258562467.754689  1258562509.653962  41.899273   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              63.245.221.11   us       "Mozilla Corporation"          80       192.168.1.104   09       "Private network"              1379     6        0x00      12       unix        Linux       unknown      0x00
A     12       0x0000000000004000  1258563573.941668  1258563576.594009  2.652341    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1397     192.168.1.1     09       "Private network"              25       6        0x01      0        win         Windows     XP           0x00
B     12       0x0000000000004001  1258563573.941709  1258563576.594045  2.652336    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1397     6        0x00      0        unix        FreeBSD     unknown      0x08
A     13       0x0000000000004000  1258565030.304653  1258565030.420837  0.116184    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1749     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     13       0x0000000000004001  1258565030.304696  1258565030.420877  0.116181    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1749     6        0x00      0        unix        FreeBSD     unknown      0x08
A     14       0x0000000000004000  1258565174.919134  1258565175.037809  0.118675    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1755     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     14       0x0000000000004001  1258565174.919179  1258565175.037828  0.118649    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1755     6        0x00      0        unix        FreeBSD     unknown      0x08
A     15       0x0000000000004000  1258565820.302090  1258565821.898589  1.596499    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49218    192.168.1.1     09       "Private network"              25       6        0x01      0        win         Windows     7 or 8       0x00
B     15       0x0000000000004001  1258565820.302128  1258565821.898612  1.596484    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49218    6        0x00      0        unix        FreeBSD     unknown      0x00
A     16       0x0000000000004000  1258565880.189257  1258565880.212242  0.022985    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49219    192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     7 or 8       0x00
B     16       0x0000000000004001  1258565880.189338  1258565880.212279  0.022941    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49219    6        0x00      0        unix        FreeBSD     unknown      0x00
A     17       0x0000000000004000  1258566050.124592  1258566050.238771  0.114179    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49220    192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     7 or 8       0x00
B     17       0x0000000000004001  1258566050.124650  1258566050.238828  0.114178    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49220    6        0x00      0        unix        FreeBSD     unknown      0x00
A     18       0x0000000000004000  1258566123.706408  1258566123.739652  0.033244    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1806     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     18       0x0000000000004001  1258566123.706462  1258566123.739692  0.033230    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1806     6        0x00      0        unix        FreeBSD     unknown      0x00
A     19       0x0000000000004000  1258567109.383510  1258567113.574618  4.191108    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1400     192.168.1.1     09       "Private network"              25       6        0x01      0        win         Windows     XP           0x00
B     19       0x0000000000004001  1258567109.383558  1258567113.574642  4.191084    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1400     6        0x00      0        unix        FreeBSD     unknown      0x08
A     20       0x0000000000004000  1258567248.261596  1258567248.374768  0.113172    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1404     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     20       0x0000000000004001  1258567248.261635  1258567248.374809  0.113174    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1404     6        0x00      0        unix        FreeBSD     unknown      0x00
A     21       0x0000000000004000  1258567289.262109  1258567289.283592  0.021483    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1405     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     21       0x0000000000004001  1258567289.262156  1258567289.283642  0.021486    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1405     6        0x00      0        unix        FreeBSD     unknown      0x00
A     22       0x0000000000004000  1258567757.457759  1258567757.572930  0.115171    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49336    192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     7 or 8       0x00
B     22       0x0000000000004001  1258567757.457805  1258567757.572984  0.115179    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49336    6        0x00      0        unix        FreeBSD     unknown      0x00
A     23       0x0000000000004000  1258568036.508358  1258568036.620287  0.111929    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49353    192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     7 or 8       0x00
B     23       0x0000000000004001  1258568036.508400  1258568036.620325  0.111925    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49353    6        0x00      0        unix        FreeBSD     unknown      0x08
A     24       0x0000000000004000  1258568059.128662  1258568059.160656  0.031994    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1836     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     24       0x0000000000004001  1258568059.128711  1258568059.160696  0.031985    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1836     6        0x00      0        unix        FreeBSD     unknown      0x00
A     25       0x0000000000004000  1258568667.549041  1258568667.662968  0.113927    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1709     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     25       0x0000000000004001  1258568667.549083  1258568667.662999  0.113916    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1709     6        0x00      0        unix        FreeBSD     unknown      0x08
A     26       0x0000000000004000  1258568738.108255  1258568738.141234  0.032979    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49561    192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     7 or 8       0x00
B     26       0x0000000000004001  1258568738.108301  1258568738.141266  0.032965    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49561    6        0x00      0        unix        FreeBSD     unknown      0x00
A     27       0x0000000000004000  1258574141.027462  1258574141.466197  0.438735    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1572     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     27       0x0000000000004001  1258574141.027497  1258574141.466226  0.438729    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1572     6        0x00      0        unix        FreeBSD     unknown      0x00
A     28       0x0000000000004000  1258577484.692600  1258577484.971674  0.279074    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1604     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     28       0x0000000000004001  1258577484.692644  1258577484.971707  0.279063    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1604     6        0x00      0        unix        FreeBSD     unknown      0x00
A     29       0x0000000000004000  1258577840.949762  1258577841.204606  0.254844    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1665     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     29       0x0000000000004001  1258577840.949804  1258577841.204644  0.254840    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1665     6        0x00      0        unix        FreeBSD     unknown      0x00
A     30       0x0000000000004000  1258581757.587843  1258581758.358872  0.771029    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1934     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     30       0x0000000000004001  1258581757.587891  1258581758.358901  0.771010    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1934     6        0x00      0        unix        FreeBSD     unknown      0x08
A     31       0x0000000000004000  1258582107.588230  1258582108.822693  1.234463    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              2008     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     31       0x0000000000004001  1258582107.588266  1258582108.822724  1.234458    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              2008     6        0x00      0        unix        FreeBSD     unknown      0x08
A     32       0x0000000000004000  1258583614.298059  1258583615.323171  1.025112    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1911     192.168.1.1     09       "Private network"              25       6        0x41      0        win         Windows     XP           0x00
B     32       0x0000000000004001  1258583614.298161  1258583615.323218  1.025057    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1911     6        0x00      0        unix        FreeBSD     unknown      0x08
A     33       0x0000000000004000  1258587444.865917  1258587445.631435  0.765518    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1908     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x02
B     33       0x0000000000004001  1258587444.873221  1258587445.638482  0.765261    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1908     6        0x00      7        unix        Linux       unknown      0x02
A     34       0x0000000000004000  1258587445.990733  1258587446.040428  0.049695    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1910     198.189.255.75  us       "California State University"  80       6        0x41      0        win         Windows     XP           0x02
B     34       0x0000000000004001  1258587445.998250  1258587446.047471  0.049221    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1910     6        0x00      7        unix        Linux       unknown      0x02
A     36       0x0000000000004000  1258594163.408285  1258594191.015208  27.606923   1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49330    143.166.11.10   us       "Dell"                         64334    6        0x41      0        win         Windows     7 or 8       0x42
B     36       0x0000000000004001  1258594163.487027  1258594185.427506  21.940479   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              143.166.11.10   us       "Dell"                         64334    192.168.1.105   09       "Private network"              49330    6        0x02      17       win         Windows     7 or 8       0x02
A     35       0x0000000000004000  1258594162.928342  1258594185.618346  22.690004   1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49329    143.166.11.10   us       "Dell"                         21       6        0x41      0        win         Windows     7 or 8       0x02
B     35       0x0000000000004001  1258594163.008594  1258594491.683288  328.674694  1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              143.166.11.10   us       "Dell"                         21       192.168.1.105   09       "Private network"              49329    6        0x00      16       unix        Solaris     unknown      0x42
$

The tp0fStat decoding can be found in the documentation under the doc folder or from the tp0f.h file as shown below:

tp0f + p0f rule info

If you want to see more details about the p0f rules which fired, switch TP0FRC 1 in the tp0f.h file, recompile and rerun t2.

$ t2conf tp0f -D TP0FRC=1
$ t2build tp0f
...
$ t2 -r ~/data/faf-exercise.pcap -w ~/results/
...
$ tcol ~/results/faf-exercise_flows.txt
%dir  flowInd  flowStat            timeFirst          timeLast           duration    numHdrDesc  numHdrs  hdrDesc       srcMac             dstMac             ethType  ethVlanID  srcIP           srcIPCC  srcIPWho                       srcPort  dstIP           dstIPCC  dstIPWho                       dstPort  l4Proto  tp0fStat  tp0fDis  tp0fRN  tp0fClass  tp0fProg  tp0fVer  tp0fClName  tp0fPrName  tp0fVerName  tcpStates
A     1        0x0000000000004000  1258544215.037210  1258544215.372742  0.335532    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1258     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x01      0        33      1          1         2        win         Windows     XP           0x00
B     1        0x0000000000004001  1258544215.202900  1258544215.537951  0.335051    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1258     6        0x00      17       0       2          5         0        unix        Solaris     unknown      0x00
A     2        0x0000000000004000  1258544216.385370  1258544216.723144  0.337774    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1259     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     2        0x0000000000004001  1258544216.551313  1258544216.888595  0.337282    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1259     6        0x00      17       0       2          5         0        unix        Solaris     unknown      0x00
A     3        0x0000000000004000  1258544216.908284  1258544217.008468  0.100184    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1260     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     3        0x0000000000004001  1258544216.915576  1258544217.008019  0.092443    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1260     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x00
A     4        0x0000000000004000  1258544217.003718  1258544217.348506  0.344788    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1261     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     4        0x0000000000004001  1258544217.169421  1258544217.513942  0.344521    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1261     6        0x00      17       0       2          5         0        unix        Solaris     unknown      0x00
A     5        0x0000000000004000  1258544217.349751  1258544217.413719  0.063968    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1262     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     5        0x0000000000004001  1258544217.357036  1258544217.413505  0.056469    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1262     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x00
A     6        0x0000000000004000  1258544217.408963  1258544217.754495  0.345532    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1263     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     6        0x0000000000004001  1258544217.574652  1258544217.919686  0.345034    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1263     6        0x00      17       0       2          5         0        unix        Solaris     unknown      0x00
A     7        0x0000000000004000  1258544217.755746  1258544217.791475  0.035729    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1264     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     7        0x0000000000004001  1258544217.763049  1258544217.791016  0.027967    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1264     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x00
A     8        0x0000000000004000  1258544217.786474  1258544218.129260  0.342786    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1265     77.67.44.206    fr       "GTT Communications Inc."      80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     8        0x0000000000004001  1258544217.952162  1258544218.294696  0.342534    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              77.67.44.206    fr       "GTT Communications Inc."      80       192.168.1.104   09       "Private network"              1265     6        0x00      17       0       2          5         0        unix        Solaris     unknown      0x00
A     9        0x0000000000004000  1258544218.130258  1258544218.166240  0.035982    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1266     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     9        0x0000000000004001  1258544218.137543  1258544218.165782  0.028239    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1266     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x00
A     11       0x0000000000004000  1258562478.204828  1258562509.633367  31.428539   1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1384     63.245.221.11   us       "Mozilla Corporation"          80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     11       0x0000000000004001  1258562478.266384  1258562509.653978  31.387594   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              63.245.221.11   us       "Mozilla Corporation"          80       192.168.1.104   09       "Private network"              1384     6        0x00      12       0       2          2         0        unix        Linux       unknown      0x00
A     10       0x0000000000004000  1258562467.749142  1258562509.633370  41.884228   1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1379     63.245.221.11   us       "Mozilla Corporation"          80       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     10       0x0000000000004001  1258562467.754689  1258562509.653962  41.899273   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              63.245.221.11   us       "Mozilla Corporation"          80       192.168.1.104   09       "Private network"              1379     6        0x00      12       0       2          2         0        unix        Linux       unknown      0x00
A     12       0x0000000000004000  1258563573.941668  1258563576.594009  2.652341    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1397     192.168.1.1     09       "Private network"              25       6        0x01      0        33      1          1         2        win         Windows     XP           0x00
B     12       0x0000000000004001  1258563573.941709  1258563576.594045  2.652336    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1397     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     13       0x0000000000004000  1258565030.304653  1258565030.420837  0.116184    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1749     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     13       0x0000000000004001  1258565030.304696  1258565030.420877  0.116181    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1749     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     14       0x0000000000004000  1258565174.919134  1258565175.037809  0.118675    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1755     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     14       0x0000000000004001  1258565174.919179  1258565175.037828  0.118649    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1755     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     15       0x0000000000004000  1258565820.302090  1258565821.898589  1.596499    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49218    192.168.1.1     09       "Private network"              25       6        0x01      0        39      1          1         31       win         Windows     7 or 8       0x00
B     15       0x0000000000004001  1258565820.302128  1258565821.898612  1.596484    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49218    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     16       0x0000000000004000  1258565880.189257  1258565880.212242  0.022985    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49219    192.168.1.1     09       "Private network"              25       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x00
B     16       0x0000000000004001  1258565880.189338  1258565880.212279  0.022941    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49219    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     17       0x0000000000004000  1258566050.124592  1258566050.238771  0.114179    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49220    192.168.1.1     09       "Private network"              25       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x00
B     17       0x0000000000004001  1258566050.124650  1258566050.238828  0.114178    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49220    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     18       0x0000000000004000  1258566123.706408  1258566123.739652  0.033244    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1806     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     18       0x0000000000004001  1258566123.706462  1258566123.739692  0.033230    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1806     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     19       0x0000000000004000  1258567109.383510  1258567113.574618  4.191108    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1400     192.168.1.1     09       "Private network"              25       6        0x01      0        33      1          1         2        win         Windows     XP           0x00
B     19       0x0000000000004001  1258567109.383558  1258567113.574642  4.191084    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1400     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     20       0x0000000000004000  1258567248.261596  1258567248.374768  0.113172    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1404     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     20       0x0000000000004001  1258567248.261635  1258567248.374809  0.113174    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1404     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     21       0x0000000000004000  1258567289.262109  1258567289.283592  0.021483    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1405     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     21       0x0000000000004001  1258567289.262156  1258567289.283642  0.021486    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1405     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     22       0x0000000000004000  1258567757.457759  1258567757.572930  0.115171    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49336    192.168.1.1     09       "Private network"              25       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x00
B     22       0x0000000000004001  1258567757.457805  1258567757.572984  0.115179    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49336    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     23       0x0000000000004000  1258568036.508358  1258568036.620287  0.111929    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49353    192.168.1.1     09       "Private network"              25       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x00
B     23       0x0000000000004001  1258568036.508400  1258568036.620325  0.111925    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49353    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     24       0x0000000000004000  1258568059.128662  1258568059.160656  0.031994    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1836     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     24       0x0000000000004001  1258568059.128711  1258568059.160696  0.031985    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1836     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     25       0x0000000000004000  1258568667.549041  1258568667.662968  0.113927    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1709     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     25       0x0000000000004001  1258568667.549083  1258568667.662999  0.113916    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1709     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     26       0x0000000000004000  1258568738.108255  1258568738.141234  0.032979    1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49561    192.168.1.1     09       "Private network"              25       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x00
B     26       0x0000000000004001  1258568738.108301  1258568738.141266  0.032965    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.105   09       "Private network"              49561    6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     27       0x0000000000004000  1258574141.027462  1258574141.466197  0.438735    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1572     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     27       0x0000000000004001  1258574141.027497  1258574141.466226  0.438729    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1572     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     28       0x0000000000004000  1258577484.692600  1258577484.971674  0.279074    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1604     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     28       0x0000000000004001  1258577484.692644  1258577484.971707  0.279063    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1604     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     29       0x0000000000004000  1258577840.949762  1258577841.204606  0.254844    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1665     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     29       0x0000000000004001  1258577840.949804  1258577841.204644  0.254840    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.104   09       "Private network"              1665     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x00
A     30       0x0000000000004000  1258581757.587843  1258581758.358872  0.771029    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              1934     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     30       0x0000000000004001  1258581757.587891  1258581758.358901  0.771010    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              1934     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     31       0x0000000000004000  1258582107.588230  1258582108.822693  1.234463    1           3        eth:ipv4:tcp  00:0b:db:63:5b:d4  00:19:e3:e7:5d:23  0x0800              192.168.1.103   09       "Private network"              2008     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     31       0x0000000000004001  1258582107.588266  1258582108.822724  1.234458    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:5b:d4  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.103   09       "Private network"              2008     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     32       0x0000000000004000  1258583614.298059  1258583615.323171  1.025112    1           3        eth:ipv4:tcp  00:0b:db:63:58:a6  00:19:e3:e7:5d:23  0x0800              192.168.1.102   09       "Private network"              1911     192.168.1.1     09       "Private network"              25       6        0x41      0        33      1          1         2        win         Windows     XP           0x00
B     32       0x0000000000004001  1258583614.298161  1258583615.323218  1.025057    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:63:58:a6  0x0800              192.168.1.1     09       "Private network"              25       192.168.1.102   09       "Private network"              1911     6        0x00      0        0       2          4         0        unix        FreeBSD     unknown      0x08
A     33       0x0000000000004000  1258587444.865917  1258587445.631435  0.765518    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1908     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x02
B     33       0x0000000000004001  1258587444.873221  1258587445.638482  0.765261    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1908     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x02
A     34       0x0000000000004000  1258587445.990733  1258587446.040428  0.049695    1           3        eth:ipv4:tcp  00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800              192.168.1.104   09       "Private network"              1910     198.189.255.75  us       "California State University"  80       6        0x41      0        33      1          1         2        win         Windows     XP           0x02
B     34       0x0000000000004001  1258587445.998250  1258587446.047471  0.049221    1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800              198.189.255.75  us       "California State University"  80       192.168.1.104   09       "Private network"              1910     6        0x00      7        0       2          2         0        unix        Linux       unknown      0x02
A     36       0x0000000000004000  1258594163.408285  1258594191.015208  27.606923   1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49330    143.166.11.10   us       "Dell"                         64334    6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x42
B     36       0x0000000000004001  1258594163.487027  1258594185.427506  21.940479   1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              143.166.11.10   us       "Dell"                         64334    192.168.1.105   09       "Private network"              49330    6        0x02      17       132     1          1         31       win         Windows     7 or 8       0x02
A     35       0x0000000000004000  1258594162.928342  1258594185.618346  22.690004   1           3        eth:ipv4:tcp  00:08:74:38:01:b4  00:19:e3:e7:5d:23  0x0800              192.168.1.105   09       "Private network"              49329    143.166.11.10   us       "Dell"                         21       6        0x41      0        39      1          1         31       win         Windows     7 or 8       0x02
B     35       0x0000000000004001  1258594163.008594  1258594491.683288  328.674694  1           3        eth:ipv4:tcp  00:19:e3:e7:5d:23  00:08:74:38:01:b4  0x0800              143.166.11.10   us       "Dell"                         21       192.168.1.105   09       "Private network"              49329    6        0x00      16       0       2          5         0        unix        Solaris     unknown      0x4
...

tp0f and httpSniffer userAgent

Load the httpSniffer plugin, recompile and rerun t2. Then select only the srcIP of basicFlow, the standard tp0f fields and the usrAgent of httpSniffer to compare the output.

$ t2build httpSniffer
...
$ t2 -r ~/data/faf-exercise.pcap -w ~/results/
...
$ tawk '{ print $srcIP, $tp0fStat, $tp0fDis, $tp0fClName, $tp0fPrName, $tp0fVerName, $httpUsrAg }' ~/results/faf-exercise_flows.txt | sort -Vr -k1,1 | uniq | tcol
srcIP           tp0fStat  tp0fDis  tp0fClName  tp0fPrName  tp0fVerName  httpUsrAg
198.189.255.75  0x00      7        unix        Linux       unknown      
192.168.1.105   0x41      0        win         Windows     7 or 8       
192.168.1.105   0x01      0        win         Windows     7 or 8       
192.168.1.104   0x41      0        win         Windows     XP           "Thunderbird 2.0.0.23 (Windows/20090812)"
192.168.1.104   0x41      0        win         Windows     XP           "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23"
192.168.1.104   0x41      0        win         Windows     XP           "AVGINET9-WXPPX86 90 AVI=270.14.72/2511 BUILD=707 LOC=1033 LIC=9I-ASXNN-X4WGW-M0XFR-T84VX-3VX02 DIAG=51E OPF=0 PCA="
192.168.1.104   0x41      0        win         Windows     XP           "AVGINET9-WXPPX86 90 AVI=270.14.71/2510 BUILD=707 LOC=1033 LIC=9I-ASXNN-X4WGW-M0XFR-T84VX-3VX02 DIAG=51E OPF=0 PCA="
192.168.1.104   0x01      0        win         Windows     XP           "AVGINET9-WXPPX86 90 AVI=270.14.71/2510 BUILD=707 LOC=1033 LIC=9I-ASXNN-X4WGW-M0XFR-T84VX-3VX02 DIAG=51E OPF=0 PCA="
192.168.1.103   0x41      0        win         Windows     XP           
192.168.1.103   0x01      0        win         Windows     XP           
192.168.1.102   0x41      0        win         Windows     XP           
192.168.1.102   0x01      0        win         Windows     XP           
192.168.1.1     0x00      0        unix        FreeBSD     unknown      
143.166.11.10   0x02      17       win         Windows     7 or 8       
143.166.11.10   0x00      16       unix        Solaris     unknown      
77.67.44.206    0x00      17       unix        Solaris     unknown      
63.245.221.11   0x00      12       unix        Linux       unknown
$

Note that only for http traffic a userAgent is present, for the rest you have to live with the tp0f output.

I need to produce a suitable sll traffic to commence the tutorial with the p0f plugin. If you load it, you also need to load the sslDecode.

Don’t forget to reset tp0f config.

$ t2conf tp0f -D TP0FRC=0
$ t2build tp0f
...
$

Have fun!