@conf.commands.register
def p0f(pkt):
 (db, sig) = packet2p0f(pkt)
 if db:
  pb = db.get_base()
 else:
  pb = []
 if (not pb):
  warning('p0f base empty.')
  return []
 r = []
 max = (len(sig[4].split(',')) + 5)
 for b in pb:
  d = p0f_correl(sig, b)
  if (d == max):
   r.append((b[6], b[7], (b[1] - pkt[IP].ttl)))
 return r

@ conf . commands . register def p0f ( pkt ) : ( db , sig ) = packet2p0f ( pkt ) if db : pb = db . get_base ( ) else : pb = [ ] if ( not pb ) : warning ( 'p0f base empty.' ) return [ ] r = [ ] max = ( len ( sig [ 4 ] . split ( ',' ) ) + 5 ) for b in pb : d = p0f_correl ( sig , b ) if ( d == max ) : r . append ( ( b [ 6 ] , b [ 7 ] , ( b [ 1 ] - pkt [ IP ] . ttl ) ) ) return r
passive os fingerprinting: which os emitted this tcp packet ? p0f -> accuracy .