From ddb4c5d0a88e0a7a4d5068a438f4077ab6f687e8 Mon Sep 17 00:00:00 2001
From: n0mad1k <n0mad1k@homelab.local>
Date: Fri, 10 Apr 2026 07:06:50 -0400
Subject: [PATCH] Expand p0f OS fingerprint signatures from 16 to 102 entries

Comprehensive p0f-style TCP SYN signatures covering Linux (kernel 2.0-6.x,
Android, Chrome OS, Alpine, containers), Windows (2000 through 11/Server
2022, XP, Embedded), macOS (Tiger through Sonoma), iOS/iPadOS/tvOS/watchOS,
BSDs (Free/Open/Net/DragonFly), Solaris/illumos, network devices (Cisco
IOS/NX-OS/IOS-XE, Juniper, MikroTik, Ubiquiti, pfSense, OPNsense,
Fortinet, Palo Alto, Aruba, F5, HP ProCurve, Arista), printers (HP,
Brother, Epson, Canon, Xerox, Ricoh, Kyocera, Lexmark, Zebra), embedded/
IoT (lwIP, uIP, VxWorks, QNX, Zephyr, ESP-IDF, FreeRTOS, Contiki-NG,
Windows IoT), gaming consoles, and virtualization guests.

DevTrack: bigbrother #419
---
 scripts/build_data.py | 133 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 117 insertions(+), 16 deletions(-)

diff --git a/scripts/build_data.py b/scripts/build_data.py
index c660a0f..95b74ae 100755
--- a/scripts/build_data.py
+++ b/scripts/build_data.py
@@ -447,31 +447,132 @@ def create_os_sigs_db(db_path: str) -> None:
         CREATE INDEX IF NOT EXISTS idx_sigs_ttl_window ON signatures(ttl, window);
     """)
 
-    # Common OS fingerprints (TTL, window, DF, MSS, OS, version)
+    # Comprehensive OS fingerprints (TTL, window, DF, MSS, OS, version)
+    # Based on p0f v3 signature database and real-world observations
     sigs = [
-        # Linux
-        (64, 29200, 1, 1460, "Linux", "3.x-5.x"),
+        # ── Linux ────────────────────────────────────────────────────
+        (64, 29200, 1, 1460, "Linux", "3.11-5.x (default)"),
         (64, 65535, 1, 1460, "Linux", "2.6.x"),
         (64, 5840, 1, 1460, "Linux", "2.6.x (older)"),
         (64, 14600, 1, 1460, "Linux", "3.x"),
-        (64, 26883, 1, 1460, "Linux", "Android"),
-        # Windows
+        (64, 26883, 1, 1460, "Linux", "Android 10+"),
+        (64, 14480, 1, 1460, "Linux", "Android 8-9"),
+        (64, 28960, 1, 1460, "Linux", "5.x-6.x (newer)"),
+        (64, 32120, 1, 1460, "Linux", "6.x (Ubuntu 24.04)"),
+        (64, 29200, 1, 1380, "Linux", "3.x-5.x (VPN/tunnel)"),
+        (64, 65535, 1, 1400, "Linux", "2.6.x (PPPoE)"),
+        (64, 5720, 1, 1460, "Linux", "2.4.x"),
+        (64, 16384, 1, 1460, "Linux", "2.2.x"),
+        (64, 32767, 1, 1460, "Linux", "2.0.x"),
+        (64, 26883, 1, 1400, "Linux", "Android (WiFi)"),
+        (64, 64240, 1, 1460, "Linux", "5.x (RHEL 8+)"),
+        (64, 14480, 1, 1460, "Linux", "Chrome OS"),
+        (64, 65535, 1, 1360, "Linux", "WireGuard tunnel"),
+        (64, 10240, 1, 1460, "Linux", "Alpine/musl"),
+        (64, 43690, 1, 1460, "Linux", "3.x (SYN cookie)"),
+        (64, 22880, 1, 1460, "Linux", "4.x-5.x (containers)"),
+        (64, 62580, 1, 1460, "Linux", "6.x (Fedora 39+)"),
+
+        # ── Windows ──────────────────────────────────────────────────
         (128, 65535, 1, 1460, "Windows", "10/11/Server 2016+"),
-        (128, 8192, 1, 1460, "Windows", "7/Server 2008"),
-        (128, 16384, 1, 1460, "Windows", "Vista"),
-        (128, 64240, 1, 1460, "Windows", "10"),
-        # macOS
-        (64, 65535, 1, 1460, "macOS", "10.x-14.x"),
-        # FreeBSD
-        (64, 65535, 1, 1460, "FreeBSD", "12.x-14.x"),
-        # iOS / tvOS
+        (128, 8192, 1, 1460, "Windows", "7/Server 2008 R2"),
+        (128, 16384, 1, 1460, "Windows", "Vista/Server 2008"),
+        (128, 64240, 1, 1460, "Windows", "10 (build 1703+)"),
+        (128, 65535, 1, 1400, "Windows", "10/11 (PPPoE/VPN)"),
+        (128, 65535, 1, 1380, "Windows", "10/11 (tunnel)"),
+        (128, 65535, 0, 1460, "Windows", "XP SP3"),
+        (128, 64512, 0, 1460, "Windows", "XP SP1-SP2"),
+        (128, 16384, 0, 1460, "Windows", "2000"),
+        (128, 65535, 1, 1360, "Windows", "10/11 (WireGuard)"),
+        (128, 64240, 1, 1400, "Windows", "10 (PPPoE)"),
+        (128, 8192, 1, 1380, "Windows", "7 (VPN)"),
+        (128, 65535, 1, 1440, "Windows", "Server 2019/2022"),
+        (128, 65535, 1, 1460, "Windows", "Server 2022"),
+        (128, 32768, 1, 1460, "Windows", "Embedded Compact"),
+
+        # ── macOS ────────────────────────────────────────────────────
+        (64, 65535, 1, 1460, "macOS", "10.x-14.x (default)"),
+        (64, 65535, 1, 1400, "macOS", "10.x-14.x (PPPoE)"),
+        (64, 65535, 1, 1380, "macOS", "10.x-14.x (tunnel)"),
+        (64, 65535, 1, 1360, "macOS", "Sonoma (WireGuard)"),
+        (64, 65535, 1, 1220, "macOS", "10.x (6in4 tunnel)"),
+        (64, 32768, 1, 1460, "macOS", "10.4-10.5 (Tiger/Leopard)"),
+        (64, 33304, 1, 1460, "macOS", "10.6 (Snow Leopard)"),
+
+        # ── iOS / iPadOS / tvOS / watchOS ────────────────────────────
         (64, 65535, 1, 1460, "iOS", "15.x-17.x"),
-        # Network devices
-        (255, 4128, 1, 536, "Cisco IOS", ""),
+        (64, 65535, 1, 1400, "iOS", "15.x-17.x (cellular)"),
+        (64, 65535, 1, 1380, "iOS", "VPN"),
+        (64, 65535, 1, 1460, "iPadOS", "16.x-17.x"),
+        (64, 65535, 1, 1460, "tvOS", "16.x-17.x"),
+        (64, 65535, 1, 1460, "watchOS", "9.x-10.x"),
+
+        # ── FreeBSD / OpenBSD / NetBSD ──────────────────────────────
+        (64, 65535, 1, 1460, "FreeBSD", "12.x-14.x"),
+        (64, 65535, 1, 1460, "FreeBSD", "PlayStation (Orbis)"),
+        (64, 32768, 1, 1460, "FreeBSD", "10.x-11.x"),
+        (64, 16384, 1, 1460, "OpenBSD", "6.x-7.x"),
+        (64, 16384, 1, 1460, "NetBSD", "9.x-10.x"),
+        (64, 57344, 1, 1460, "DragonFly BSD", "6.x"),
+
+        # ── Solaris / illumos ────────────────────────────────────────
+        (64, 49232, 1, 1460, "Solaris", "10"),
+        (64, 32806, 1, 1460, "Solaris", "11.x"),
+        (255, 49640, 1, 1460, "Solaris", "8"),
+
+        # ── Network devices ──────────────────────────────────────────
+        (255, 4128, 1, 536, "Cisco IOS", "12.x-15.x"),
+        (255, 16384, 1, 1460, "Cisco IOS", "17.x (IOS-XE)"),
+        (255, 8192, 1, 1460, "Cisco NX-OS", ""),
         (64, 16384, 1, 1460, "Juniper JunOS", ""),
-        # Printers
+        (64, 14600, 1, 1460, "Juniper JunOS", "21.x+"),
+        (64, 65535, 1, 1460, "MikroTik RouterOS", "6.x-7.x"),
+        (64, 32120, 1, 1460, "Ubiquiti EdgeOS", ""),
+        (64, 29200, 1, 1460, "Ubiquiti UniFi OS", ""),
+        (255, 4128, 1, 536, "HP ProCurve", ""),
+        (128, 8192, 1, 1460, "Arista EOS", ""),
+        (64, 28960, 1, 1460, "pfSense", "2.x"),
+        (64, 65535, 1, 1460, "OPNsense", "23.x+"),
+        (255, 4096, 1, 536, "Fortinet FortiOS", ""),
+        (255, 65535, 1, 1460, "Palo Alto PAN-OS", ""),
+        (64, 65535, 1, 1460, "Aruba AOS", ""),
+        (128, 65535, 1, 1460, "F5 BIG-IP", "TMOS"),
+
+        # ── Printers ────────────────────────────────────────────────
         (128, 8192, 1, 1460, "HP JetDirect", ""),
         (128, 8192, 1, 1460, "Brother", ""),
+        (128, 16384, 1, 1460, "Epson", ""),
+        (128, 8192, 1, 1460, "Canon", ""),
+        (128, 8192, 1, 1460, "Xerox", ""),
+        (128, 8192, 1, 1460, "Ricoh", ""),
+        (128, 4096, 1, 1460, "Kyocera", ""),
+        (128, 8192, 1, 1460, "Lexmark", ""),
+        (64, 8192, 1, 1460, "Zebra", "label printer"),
+
+        # ── Embedded / IoT ──────────────────────────────────────────
+        (64, 5840, 1, 1460, "lwIP", "embedded stack"),
+        (64, 2048, 1, 1460, "uIP", "microcontroller"),
+        (64, 65535, 1, 1460, "VxWorks", ""),
+        (64, 4096, 1, 536, "RTOS", "generic embedded"),
+        (64, 16384, 1, 1460, "QNX", ""),
+        (128, 65535, 1, 1460, "Windows IoT Core", ""),
+        (64, 14600, 1, 1460, "Zephyr RTOS", ""),
+        (64, 5840, 1, 1460, "ESP-IDF", "ESP32"),
+        (64, 1024, 1, 536, "Contiki-NG", ""),
+        (64, 2144, 1, 1460, "FreeRTOS+TCP", ""),
+
+        # ── Gaming consoles ──────────────────────────────────────────
+        (64, 65535, 1, 1460, "FreeBSD", "PlayStation 4"),
+        (64, 65535, 1, 1460, "FreeBSD", "PlayStation 5"),
+        (128, 65535, 1, 1460, "Windows", "Xbox Series X/S"),
+        (64, 65535, 1, 1460, "Nintendo", "Switch"),
+
+        # ── Virtualization ──────────────────────────────────────────
+        (64, 29200, 1, 1460, "Linux", "Docker container"),
+        (64, 29200, 1, 1460, "Linux", "Kubernetes pod"),
+        (64, 26883, 1, 1460, "Linux", "WSL2"),
+        (128, 64240, 1, 1460, "Windows", "Hyper-V guest"),
+        (64, 65535, 1, 1460, "FreeBSD", "bhyve guest"),
     ]
 
     conn.executemany("""