pcf - PC Fingerprinter

Copyright (C) 2013 Barbora Franková <[email protected]>
                   Jakub Jirasek <[email protected]>
                   Libor Polčák <[email protected]>

This is a README file for pcf -- a tool for remote computer identification. The
identification is done according to skew of the clocks inside each computer.
Clock skew of a specific computer is computed from TCP timestamps. The program
runs in an infinite loop and its output is a XML file containing recognized
computers. The program was developed and tested in GNU/Linux.

For install and uninstall instructions see INSTALL file.

Usage
-----

Program has to be run as root or it has to have capabilities to listen for data
on network interfaces.

Usage: pcf [Options] [Interface]

  -h		Help
  -n		Number of packets to capture (0 -- default means infinity)
  -t		Number of seconds to capture (0 -- default means infinity)
  -p		Port number (1-65535, 0 -- default means all)
  -i        Disable ICMP
  -d        Debug mode

Examples:
  pcf
  pcf -n 100 -t 600 -p 80 wlan0

The first example runs the program according to parameters listed in the config
file.

It is possible to stop the program by sending SIGINT or SIGTERM.

You can find more instructions about program configuration in the config file.
All options are commented.

You can configure your web server and enable web interface. You can see
recognized computers and manage them in your browser.


Files and directories
---------------------

bin/		         - binary files (installed version of the program)
src/		         - source files

src/
  pcf		         - pcf program
  log_reader         - log reader program
  
  bulk_log_reader.sh - bulk log processing script
  coupler.py         - clock skew comparison script
  match_finder.sh    - bulk clock skew comparison script

  config	         - configuration file

  bulk_output/	     - bulk processing output directory
  graph/	         - graphs of the recognized computers
  log/		         - files containing log of drifts of monitored computers. These files are
      required for graph construction.
  www/		     - web interface


Project origins
---------------

The very first revision in the pcf repository (https://github.com/polcak/pcf) is
the result of diploma thesis of Jakub Jirasek, which was successfuly finished at
Faculty of Information Technology, Brno University of Technology. You can see
the report on http://www.fit.vutbr.cz/study/DP/DP.php.en?id=14040&y=2011 (the
text is in Czech).

The idea of computer identification based on TCP timestamps was first published
in:
Kohno, T.; Broido, A.; Claffy, K.: Remote physical device fingerprinting. IEEE
Transactions on Dependable and Secure Computing, volume 2, no. 2, May 2005: pp.
93–108, ISSN 1545-5971.