haruu77g/phantomprint

Phantomprint is a tool that figures out what operating system, browser, or device a computer on a network is using, without ever sending it a single packet. It watches normal network traffic that is already passing by, such as the start of a TCP connection, a TLS handshake, or a DHCP request, and reads small technical details in each one, like timing values and option orders, to guess what software produced them. Instead of relying on just one of these signals, it combines several of them, such as the TCP/IP handshake pattern, the TLS JA4 fingerprint, and DHCP option ordering, and produces a single host profile with a confidence score. The README compares it to older tools like p0f, which only look at one signal type and have not been updated in years, and argues that nothing else on the market merges multiple passive signals into one scored result. It can run in two ways: watching a live network interface, which needs root access and Python 3.11 or newer, or analyzing an already captured PCAP file, which does not need root. Results can be printed to the terminal or saved as JSON. Its detection rules are stored as readable YAML files describing the network patterns tied to each operating system or browser, and new rules can be added by dropping in more YAML files, which are picked up automatically. The README describes its intended use for authorized network monitoring: quietly mapping devices during a penetration test's early stages, spotting unexpected devices on a network, and reconstructing which systems were active from old traffic captures. It states plainly that it is meant only for networks the user owns or has explicit permission to monitor, and that passive fingerprinting still falls under a recognized network sniffing technique that needs proper authorization first. The project is licensed under GPL-3.0.