So just for the record, version 3.00 is now officially out: http://lcamtuf.coredump.cx/p03/. Many thanks to countless people who submitted signatures and bug fixes, including: Phil Ames Jason DePriest Dalibor Dukic Mark Martinec Damien Miller Nibbler Bernhard Rabe Chris John Riley Sebastian Roschke Peter Valchev Jeff Weisberg I won't be spamming the list with any further updates on p0f, but this being a major rewrite after ~6 years, I thought it makes sense to let people know - especially since the previous version is used in quite a few abuse detection / monitoring / pentesting frameworks. /mz