diff --git a/bpftools/p0f.py b/bpftools/p0f.py index 3c3169a..5d72f87 100644 --- a/bpftools/p0f.py +++ b/bpftools/p0f.py @@ -52,6 +52,8 @@ def parse_ittl(self): if self.ittl.endswith("-"): self.ttl_rand = True else: + if "+" in self.ittl: + self.ittl, _ = self.ittl.split("+") self.ttl_rand = False def parse_win_size(self): @@ -78,7 +80,7 @@ def parse_sig(self): if self.ver != '4' and self.ver != '6': raise ValueError("IP version must be either 4 or 6") - if not re.match("^(\d+)-?$", self.ittl): + if not re.match("^(\d+)(-|\+\d+|\+\?)?$", self.ittl): raise ValueError("Invalid ttl field") self.parse_ittl()