p0f is back!

I decided to spend some time rewriting and greatly improving my ancient but strangely popular passive fingerprinting tool:

• http://lcamtuf.coredump.cx/p0f3/
  

Version 3 is a complete rewrite, bringing you much improved SYN and SYN+ACK fingerprinting capabilities, auto-calibrated uptime measurements, completely redone databases and signatures, new API design, IPv6 support (who knows, maybe it even works?), stateful traffic inspection with thorough cross-correlation of collected data, application-level fingerprinting modules (for HTTP now, more to come), and a lot more.