The signatures in p0f.fp.websigs are unverified; they have not been individually checked for accuracy. That said, they're probably correct and probably safe to use in identifying remote systems. If you'd like to try them, do the following: cp -p /etc/p0f.fp /etc/p0f.fp.backup cat /etc/p0f.fp.backup | grep -v 'unverified$' >/etc/p0f.fp cat p0f.fp.websigs.v0.4.1 >>/etc/p0f.fp #Note the _two_ '>'s Because there will be over 3000 signatures, you'll need to edit p0f.c and change: #define MAXFPS 1000 to #define MAXFPS 6000 and then type: make all make install Stop and restart p0f, perhaps with: /etc/init.d/p0f restart p0f will now be using the new signatures. If you can verify any of them, please let Bill Stearns at wstearns@pobox.com know so they can be migrated over to the main database.