=for comment $Id: synos.pod,v 1.5 2006/02/20 23:34:14 dm Exp $

=head1 NAME

synos - guess operating system from TCP SYN fingerprint

=head1 SYNOPSIS

synos [--mtu I<mtu>] [I<--db> I<path>] I<syn-fingerprint>

=head1 DESCRIPTION

synos takes a SYN fingerprint, in the format described for the
B<CLIENT_SYNFP> environment variable in the L<avenger(1)|avenger(1)>
man page, and outputs a guess as to the type of the client operating
system.  synos makes use of the OpenBSD SYN fingerprint database
(which is also repackaged with Mail Avenger).

=head2 OPTIONS

=over

=item B<--mtu> I<val>

Certain operating systems set the initial TCP window size based on the
maximum transmission unit, or MTU, of the network.  For such operating
systems, synos usually checks the window size using both the client's
MSS option plus 40 bytes (for TCP and IP headers), or a hard-coded
MTU, which defaults to 1,500 bytes.  If either value works, the
fingerprint is considered to match the operating system.  You can
change the value 1,500 by specifying this option.  A value of 0 tells
synos to use only the value derived from the MSS option.

=item B<--db> I<file>

Specifies an alternate location for the SYN fingerprint database.

=back

=head1 FILES

=over

=item F<@datadir@/pf.os>

Default location of SYN fingerprint database.

=back

=head1 SEE ALSO

L<avenger(1)|avenger(1)>,
L<asmtpd(8)|dotlock(8)>

The Mail Avenger home page: L<http://www.mailavenger.org/>.

The OpenBSD home page: L<http://www.openbsd.org/>.

=head1 BUGS

The operating system type is determined by heuristics that are not
always reliable.  Moreover, not all operating systems can be
distinguished.  The database may not even contain a client's
particular operating system and version.

It is not hard to fool synos deliberately by changing TCP socket
options or injecting raw packets onto the network.

=head1 AUTHOR

David MaziE<egrave>res