:param s: user agent or p0f OS fingerprint :return: assumed OS parsed out of the input string

Is the ASN suspicious? :param request: :return: True iff ASN hints it is a security tool

:return: True iff we've recently seen a service checking our server

Checks if the MTU value is atypical :param request: the HTTP GET headers :return: True iff MTU value is suspicious

Detect implementations where developers neglected to update their code to reflect contemporary browser versions :param request: :return:

Compare the declared OS and TCP metadata OS Uses get_os_string to transform to a canonical form :param request: the HTTP GET headers

:param request: :return: true iff VirusTotal request is received

Gets asnum for ip using Cymru's API (https://pythonhosted.org/cymruwhois/api.html) Stores in cache for future use using the lru_cache dec

Wraps p0f's named socket API Wrapper module in use is https://pypi.org/project/p0f/ :param ip: key to query p0f by it :return: p0f's

:param ip: ipv4 as string :return: reversed in-addr-arpa part of the record e.g.: for '203.208.60.1' it will return 'crawl-203-208-60-1.g

build parsed headers from request :return: headers prepared for fingerprinting stage

Prints an ASCII art pstf^2 banner :return: None

Resets the timer for last time we've observed a service to evade from :return:

Wrapper for popen :param cmd: cmd to run as a different process :return: ref to the popened subprocess

Here we start both p0f and an HTTP server in parallel :return:

Logic for serving HTTP GET requests :return:

Main routine for sending to the different checks :param request: :return: True iff request matches blacklist patterns

Initialize the server, will be started in a differnt thread than p0f so it will co-exist :param server_class: standard python HTTP server

Starts p0f's binary :param p0f_bin_path: binary file path on disk :param p0f_fp_path: fingerprint file path on disk :param p0f_iface: