nccgroup/umap — pull request #2 by smy1es (2014-04-25 21:08:33+00:00)
Title: Modify OS fingerprint feature to use a fingerprint file

This patch modifies umap to use a fingerprint file for its OS matches instead of them being hard-coded in the python file. It uses json file as a convenient file storage format which is easily parseable in python.

Hopefully the format of the fingerprint file is reasonably self-evident. There are three possible match types: *match-freq* which counts how often a particular message type is in the fingerprint, *match-count* which counts how many messages are in the fingerprint and *match-pos* which checks to see if a particular message is at a particular position. The *match-condition* is the name of any of the inbuilt rich comparison methods documented in the standard python data model. __lt__, __le__, __eq__, __ne__, __gt__ and __ge__ are the obvious values to put in here.

I also have a huge bundle of other fingerprints to parse. Various cars, Solaris, multiple BSD variants, strange telco equipment and anything else I could find. It would be great to get lots of examples from anyone who has them.