Identifying devices and operating systems with p0f

Let’s get started with p0f. p0f is a small tool that can be used to passively scan and detect operating systems within a network. This scanning tool is considered passive because it does not send data to other hosts apart from Synchronize (SYN) packets. This is very useful when trying to quietly collect information about other hosts on a network in DFIR investigations.

Let’s look at how to install and use p0f to detect other host operating systems on the network:

1. Depending on the version of Kali you are running (2019.3 – 2023.1), you can run the p0f –h command to determine whether it is preinstalled. If not, Kali will ask whether you would like to install it. Press y to accept and install it, as seen in the following screenshot.

Figure 11.1 – Installing p0f in Kali

2. Run the p0f –h command again after installation. This displays the network interface...