p0f

---

What p0f actually does

Passive operating-system fingerprinting from TCP/IP stack behaviour alone — window sizes, option ordering, timing — requiring no cooperation from the client and no application-layer data at all.

What p0f's maintenance signals mean

pushed_at reads 2019-07-09 — 2593 days, about 7.1 years, past the 1095-day outer threshold. Three years is where this register stops describing a repository as merely quiet.

DEAD in this catalogue is a statement about a measurement, not an obituary. The code is still there and may still compile; what has stopped is anybody attending to it. Read that against what the project is for. A passive fingerprinting reference from a decade ago can be entirely current as a description of a technique while being entirely unmaintained as software, and this register prints the second fact without implying the first.

No release was captured for this entry, which this register records as unknown rather than as none. The distinction matters more than it looks: a project with no tags and a project whose tags the sweep failed to read produce the same blank cell, and printing them as the same fact would be the register asserting something it has not measured.

Where p0f sits in this catalogue

p0f is filed in section 07, network, tls & http fingerprint tooling, whose scope is this: The layer below JavaScript: TLS ClientHello and HTTP/2 fingerprinting, impersonating clients, and the passive tooling that reads them. An entry sits in exactly one section here. Where a project could defensibly go in two, it is placed where a reader would look for it first rather than where it fits most tidily, and that is an editorial decision rather than a measured one.

Filed beside it in the same section: nginx-http2-fingerprint (DEAD), mitmproxy (ACTIVE). Comparing an entry against its own section-mates is more informative than comparing it against the catalogue as a whole, because everything in a section is answering roughly the same question and the differences left over are the ones that matter.

Its licence field is empty, and this register treats that as a finding rather than a gap — see every entry here that declares no licence. Source you can read is not source you have been granted the right to use, modify or redistribute, and an absent licence file means exactly that absence and nothing friendlier. It is also grouped with everything else the rubric marks DEAD.

Substitutes for the same job, with no claim that either is better: JA4+. The alternative relation is symmetric and carries no ranking, because this register publishes no ranking of any kind. The full p0f comparison table sets all of them side by side on licence, push date, release cadence and state.

What to settle before you adopt p0f

The technique predates every browser-level concern in this catalogue and still works, which is the point of listing it. The code itself has not moved in years and declares no licence, so treat it as a reference rather than a dependency.