🔬 Device Fingerprinting

Automatically identify device types on your network using MAC vendor analysis, open ports, and TTL signatures.

Quick Start

Access fingerprinting from the interactive menu:

netscan
# Press 'f' for Device Fingerprinting

How It Works

Device fingerprinting combines multiple data points to identify devices:

• MAC Vendor — Manufacturer identification (Apple, Cisco, etc.)
• Open Ports — Service signatures (SSH, HTTP, DNS, etc.)
• TTL Analysis — Operating system family detection
• Port Patterns — Device-specific port combinations

Device Types Detected

CLI Usage

# Fingerprint single device
python3 helpers/fingerprint.py --target 192.168.1.1 --verbose

# Scan and fingerprint entire network
python3 helpers/fingerprint.py --scan-network --verbose

# Fingerprint from existing scan
python3 helpers/fingerprint.py --input scan_results.json

# Export fingerprints
python3 helpers/fingerprint.py --scan-network --output fingerprints.json

Sample Output

============================================================
IP: 192.168.1.1
MAC: A4:91:B1:XX:XX:XX
Device Type: router
Subtype: wireless_ap
OS Family: Linux
Manufacturer: TP-Link
TTL: 64
Open Ports: 22, 53, 80, 443
Services: ssh, dns, http, https
Confidence: 92%
============================================================

Confidence Scoring

Each identification includes a confidence score:

• 90-100% — High confidence, multiple indicators match
• 70-89% — Good confidence, most indicators match
• 50-69% — Moderate confidence, some indicators
• <50% — Low confidence, limited data

Python API

from helpers.fingerprint import DeviceFingerprinter

# Create fingerprinter
fp = DeviceFingerprinter(timeout=2.0, max_threads=20)

# Fingerprint single device
result = fp.fingerprint(
    ip="192.168.1.1",
    mac="AA:BB:CC:DD:EE:FF",
    vendor="Apple, Inc."
)

print(f"Device Type: {result.device_type}")
print(f"Confidence: {result.confidence:.0%}")
print(f"Open Ports: {result.open_ports}")

Batch Processing

# Process scan results
python3 helpers/fingerprint.py --input devices.json --output fingerprints.json

# Skip port scanning (faster, less accurate)
python3 helpers/fingerprint.py --input devices.json --no-ports