fingerprint-tcpip

Overview ¶

This example demonstrates passive TCP/IP fingerprinting: set the server's SniffDevice to a real network interface and the server captures packets destined for the TLS port on that interface, attaching the IP/TCP header details (window size, MSS, TTL, options order, ...) to each request.

Packet capture needs elevated privileges (root) and a real device name:

$ sudo go run ./examples/fingerprint-tcpip -device eth0
$ curl -k https://localhost:8443/

The TCP/IP fingerprint is keyed by "sourceIP:sourcePort", so the curl client must be reachable through the sniffed interface (use -device lo and curl https://localhost:8443/ for a quick local test).