From b13023f6ce2b80d35d86ebdfd336db6747ece2cc Mon Sep 17 00:00:00 2001 From: Meir Elbaz Date: Thu, 26 Jun 2025 15:33:12 +0300 Subject: [PATCH 1/2] fix ittl with distance --- bpftools/p0f.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bpftools/p0f.py b/bpftools/p0f.py index 3c3169a..95e8200 100644 --- a/bpftools/p0f.py +++ b/bpftools/p0f.py @@ -52,6 +52,8 @@ def parse_ittl(self): if self.ittl.endswith("-"): self.ttl_rand = True else: + if "+" in self.ittl: + self.ittl, _ = self.ittl.split("+") self.ttl_rand = False def parse_win_size(self): @@ -78,7 +80,7 @@ def parse_sig(self): if self.ver != '4' and self.ver != '6': raise ValueError("IP version must be either 4 or 6") - if not re.match("^(\d+)-?$", self.ittl): + if not re.match("^(\d+)(-|\+\d+)?$", self.ittl): raise ValueError("Invalid ttl field") self.parse_ittl() From 7a7ca1bf3762a7ea6e483e5e48a9272a1e6ec3e7 Mon Sep 17 00:00:00 2001 From: Meir Elbaz Date: Thu, 26 Jun 2025 16:53:00 +0300 Subject: [PATCH 2/2] fix ittl with unknown initial ttl --- bpftools/p0f.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bpftools/p0f.py b/bpftools/p0f.py index 95e8200..5d72f87 100644 --- a/bpftools/p0f.py +++ b/bpftools/p0f.py @@ -80,7 +80,7 @@ def parse_sig(self): if self.ver != '4' and self.ver != '6': raise ValueError("IP version must be either 4 or 6") - if not re.match("^(\d+)(-|\+\d+)?$", self.ittl): + if not re.match("^(\d+)(-|\+\d+|\+\?)?$", self.ittl): raise ValueError("Invalid ttl field") self.parse_ittl()