# p0f passive TCP/IP signature explainer

> Decode a p0f v3 SYN fingerprint into its eight fields and see what each reveals about the sender's OS, network path, and stack.

- Tool: https://ronutz.com/en/tools/p0f-signature-explainer
- Family: Networking

---

## What it does

Paste a p0f v3 SYN signature in the canonical grammar - ver:ittl:olen:mss:wsize,scale:olayout:quirks:pclass - and the tool decodes all eight fields, explains the initial-TTL and window reasoning, names every TCP option and quirk token, and matches the field shape against p0f's documented OS reference signatures. It accepts either a bare signature or the "label = sig" form.

## Why it is passive

p0f fingerprints by watching packets a host already sent - the SYN of a normal connection - and never sends a probe of its own. That is what "passive" means here, and it is why the technique is invisible to the target. This tool takes that one step further into pure teaching: you paste a signature you already hold, and nothing is read from your own machine or sent anywhere.

## The proxy tell

The single most useful reading is the initial TTL. Because every router decrements TTL, a value near 64 says Linux/BSD/Darwin, near 128 says Windows, near 255 says network gear. When that stack TTL contradicts the operating system a User-Agent claims, you are almost certainly looking at a proxy or NAT: the packet carries the intermediary's stack, not the client's. The option layout and quirks refine the guess; the tool shows each one's contribution.

## Standards and references

- [p0f v3 — signature format (docs/README)](https://github.com/p0f/p0f/blob/master/docs/README) - the ver:ittl:olen:mss:wsize,scale:olayout:quirks:pclass grammar, option tokens, quirk flags
- [p0f — bundled p0f.fp signature database](https://github.com/p0f/p0f/blob/master/p0f.fp) - the reference OS signatures used for the family hints

## Related reading

- [Passive Fingerprinting: What You Emit Without Being Asked](https://ronutz.com/en/learn/passive-fingerprinting-what-you-emit.md): Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.