# SSL fingerprinting for p0f

DevFeed: [SSL fingerprinting for p0f](<https://devfeed.tech/articles/ssl-fingerprinting-for-p0f-38906.md>)

Original publisher: [Read original article](<https://idea.popcount.org/2012-06-17-ssl-fingerprinting-for-p0f>)

Author: Marek

Published: 2012-06-16T22:00:00Z

Content type: article

Language: en

Sources: [Marek Majkowski](<https://devfeed.tech/sources/marek-majkowski.md>)

Topics: [SSL](<https://devfeed.tech/topics/ssl.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [TCP/IP](<https://devfeed.tech/topics/tcp-ip.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Firefox](<https://devfeed.tech/topics/firefox.md>)

Tags: [chrome](<https://devfeed.tech/tags/chrome.md>), [compression](<https://devfeed.tech/tags/compression.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [handshake](<https://devfeed.tech/tags/handshake.md>), [handshakes](<https://devfeed.tech/tags/handshakes.md>), [http](<https://devfeed.tech/tags/http.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [tcp-ip](<https://devfeed.tech/tags/tcp-ip.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

The article describes SSL/TLS fingerprinting for p0f. It explains how client cipher suites, extensions, ordering, protocol versions, and other handshake details can identify SSL clients such as browsers, and discusses a p0f module that matches generated fingerprints against predefined signatures.

## Source excerpt

SSL fingerprinting for p0f In January Lcamtuf announced a complete rewrite of his passive fingerprinting tool p0f. Historically p0f was a low-level tool focused on fingerprinting layer 4, mostly and TCP/IP packets. The new version of p0f is different: not only it can look at low level packets, but also it is capable of fingerprinting higher-level application protocols. Currently it is able to do HTTP fingerprinting and the author suggests other protocols might soon follow.