#NEWLINE# def p0f_getlocalsigs( ) : #NEWLINE# #INDENT# 'This function returns a dictionary of signatures indexed by p0f\ndb (e.g., p0f_kdb, p0fa_kdb, ...) for the local TCP/IP stack.\n\nYou need to have your firewall at least accepting the TCP packets\nfrom/to a high port (30000 <= x <= 40000) on your loopback interface.\n\nPlease note that the generated signatures come from the loopback\ninterface and may (are likely to) be different than those generated on\n"normal" interfaces.' #NEWLINE# pid = os . fork ( ) #NEWLINE# port = random . randint ( 30000 , 40000 ) #NEWLINE# if ( pid > 0 ) : #NEWLINE# #INDENT# result = { #NEWLINE# #INDENT# #NEWLINE# #UNINDENT# } #NEWLINE# def addresult( res ) : #NEWLINE# #INDENT# if ( res [ 0 ] not in result ) : #NEWLINE# #INDENT# result [ res [ 0 ] ] = [ res [ 1 ] ] #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( res [ 1 ] not in result [ res [ 0 ] ] ) : #NEWLINE# #INDENT# result [ res [ 0 ] ] . append ( res [ 1 ] ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# iface = conf . route . route ( '127.0.0.1' ) [ 0 ] #NEWLINE# count = 14 #NEWLINE# pl = sniff ( iface = iface , filter = ( 'tcp and port ' + str ( port ) ) , count = count , timeout = 3 ) #NEWLINE# map ( addresult , map ( packet2p0f , pl ) ) #NEWLINE# os . waitpid ( pl , 0 ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( pid < 0 ) : #NEWLINE# #INDENT# log_runtime . error ( 'fork error' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# time . sleep ( 1 ) #NEWLINE# s1 = socket . socket ( socket . AF_INET , type = socket . SOCK_STREAM ) #NEWLINE# try : #NEWLINE# #INDENT# s1 . connect ( ( '127.0.0.1' , port ) ) #NEWLINE# #UNINDENT# except socket . error : #NEWLINE# #INDENT# pass #NEWLINE# #UNINDENT# s1 . bind ( ( '127.0.0.1' , port ) ) #NEWLINE# s1 . connect ( ( '127.0.0.1' , port ) ) #NEWLINE# s1 . close ( ) #NEWLINE# os . _exit ( 0 ) #NEWLINE# #UNINDENT# #UNINDENT# return result