Scripts and output from running p0f (passive OS fingerprinting) on a live server located in Japan. Data collected during June 2015.

Scripts

• p0f-parse.rb — Parses raw p0f log files into structured fields for further analysis (CSV, etc.).
• geoip-lookup.rb — Performs a GeoIP country lookup on a single IP address.

Usage

ruby p0f-parse.rb <p0f-log-file>
ruby geoip-lookup.rb <ip-address>

GeoIP Dependencies

geoip-lookup.rb requires the geoip Ruby gem and a GeoIP.dat database file (MaxMind legacy GeoIP v1 format) in the working directory. Neither is included in this repo.

gem install geoip

Output Artifacts

• geoip-map.html — Interactive world map (Google Charts GeoChart) showing TCP connection counts by country of origin.
• geoip-uniq-tcp-ip-connects.txt — Plain-text list of countries from unique source IP connections.
• GEOIP TCP Connects.xlsx — Spreadsheet of GeoIP connection data.
• OS Fingerprinting Results.xlsx — Spreadsheet of OS fingerprinting results.

See AGENTS.md for technical details and gotchas.