[prads-devel] difference in prads.[c|pl] and p0f synack

[Edward Bjarte Fjellskål]

Edward Bjarte Fjellskål wrote:
> From prads.pl:
> [SYNACK  ] ip:195.249.20.212  Linux - 2.6 (newer, 4)
> [5792:64:1:60:M1460,S,T,N,W4:ZA] distance:5 link:ethernet/modem
> 
> From prads.c:
> 195.249.20.212,[synack:5792:59:1:60:M1460,S,T0,N,W4:ZAT],[uptime:2656hrs]
> 
> "T" seems to be the issue here.
> 
> E

p0f
More info, that can be replicated (ssh to 220.255.7.13):

prads.pl  65535:64:0:48:M1460,S:A
prads.c   65535:43:0:48:M1460,S,E,E:PA
p0f       65535:43:0:48:M1460,S,E:PA

E