What do these entries mean in the /var/log/messages file?

IT_Architect · Mar 2, 2013

What do these entries mean in the /var/log/messages file?

Code:

Mar  1 16:13:41 server kernel: dding osfp FreeBSD 5.2  = 65535:64:1:60:0x10204 6 (TS=,M=*0,W=1) 307400
Mar  1 16:13:41 server kernel: adding osfp FreeBSD 5.0-5.2  = 65535:64:1:60:0x
Mar  1 16:13:41 server kernel: adding osfp NetBSD 1.6 opera = 65535:64:0:60:0x10204 6 (TS=0,M=*0,W=0) 400801
Mar  1 16:13:41 server kernel: adding osfp NetBSD 1.6 opera = 65535:64:1:80:0x10204 6 (TS=0,M=*0,W=0) 400801
Mar  1 16:13:41 server kernel: adding osfp OpenBSD 2.6  = 16384:64:0:60:0x10204 6 (TS=,M=*0,W=0) 500400
Mar  1 16:13:41 server kernel: adding osfp OpenBSD 2.6  = 16384:64:1:80:0x
Mar  1 16:13:41 server kernel: adding osfp Solaris 8 RFC1323 = S17:64:1:64:0x20401a 9 (TS=0,M=*0,W=3
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.4  = 49152:64:0:44:0x2 1 (TS=,M=*0,W=*0) 800400
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.2  = 61440:64:0:44:0x2 1 (TS=,M=*0,W
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.3  = 61440:64:0:44:0x2 1 (TS=,M=*0,W=*0) 800c00
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.4  = 61440
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.5  = 61440:64:1:64:0x2 1 (TS=,M=*0,W=*0) 801000
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.5 14 = 61440:64:1:68:0x403 4 (TS=,M=*0,W=*0) 801004
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.5 16 = 61440:64:1:68:0x403 4 (TS=,M=*0,W=*0) 801006
Mar  1 16:13:41 server kernel: osfp IRIX 6.5 17 = 61440:64:1:68:0x403 4 (TS=,M=*0,W=*0) 801007
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.5 18 = 61440:64:1:68:0x403 4 (T
Mar  1 16:13:41 server kernel: adding osfp IRIX 6.5 12-21 = 61440:64:1:68:0x403 4 (TS=,M=*0,W=*0) 80100c
Mar  1 16:13:41 server kernel: adding osfp Tru64 4.0  = 32768:64:1:48:0x81 3 (TS=,M=*0,W=0) 900400
Mar  1 16:13:41 server kernel: adding osfp OpenVMS 7.2  = 6144:64:1:60:0x10204 6 (TS=,M=*0,W=0) a004
Mar  1 16:13:41 server kernel: adding osfp MacOS 7.3 OTTCP = 1
Mar  1 16:13:41 server kernel: adding osfp MacOS 7.4 OTTCP = 16616:255:1:48:0x11 2 (TS=,
Mar  1 16:13:41 server kernel: M=*0,W=0) b00801
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.1 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=
Mar  1 16:13:41 server kernel: *0,W=0) b01c01
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.2 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b02001
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.3 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b024
Mar  1 16:13:41 server kernel: 01
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.4 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b02801
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.5 OTTCP 
Mar  1 16:13:41 server kernel: = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b02c01
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.6 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b03001
Mar  1 16:13:41 server kernel: 
Mar  1 16:13:41 server kernel: adding osfp MacOS 8.0-8.6 OTTCP = 16616:255:1:48:0x11 2 (TS=,M=*0,W=0) b03401
Mar  1 16:13:41 server kernel: adding osfp MacOS 9.1  = 65535:255:1:68:0x2000 5 (TS=,M=*0,W=*0) b040
Mar  1 16:13:41 server kernel: 00
Mar  1 16:13:41 server kernel: adding osfp Windows 3.11  = 8192:32:1:44:0x2 1 (TS=,M=*0,W=*0) c00400
Mar  1 16:13:41 server kernel: 
Mar  1 16:13:41 server kernel: adding osfp Windows 3.11  = 8192:32:1:64:0x2 1 (TS=,M=*0,W=*0) c00400
Mar  1 16:13:41 server kernel: adding osfp Windows 95  = S44:64:1:64:0x2040803 9 (TS=0,M=*0
Mar  1 16:13:41 server kernel: ,W=0) c00800
Mar  1 16:13:41 server kernel: adding osfp Windows 95  = S44:64:1:84:0x2040803 9 (TS=0,M=*0,W=0) c00800
Mar  1 16:13:41 server kernel: adding osfp
Mar  1 16:13:41 server kernel: Windows 95 b = 8192:128:1:64:0x2040803 9 (TS=0,M=*0,W=0) c00801
Mar  1 16:13:41 server kernel: adding osfp Windows 95 b = 8192:128:1:84:0x2040
Mar  1 16:13:41 server kernel: 803 9 (TS=0,M=*0,W=0) c00801
Mar  1 16:13:41 server kernel: adding osfp Windows 98 lowTTL = S44:32:1:48:0x403 4 (TS
Mar  1 16:13:41 server kernel: =,M=*0,W=*0) c00c01
Mar  1 16:13:41 server kernel: adding osfp Windows 98 lowTTL = S44:32:1:68:0x403 4 (TS=,M=*0,W=*0) c00c01
Mar  1 16:13:41 server kernel: adding os
Mar  1 16:13:41 server kernel: fp Windows 98 lowTTL = 8192:32:1:48:0x403 4 (TS=,M=*0,W=*0) c00c01
Mar  1 16:13:41 server kernel: adding osfp Windows 98 lowTTL = 8192:32:1:68:0x4
Mar  1 16:13:41 server kernel: 03 4 (TS=,M=*0,W=*0) c00c01
Mar  1 16:13:41 server kernel: adding osfp Windows 98  = %8192:64:1:48:0x403 4 (TS=,M=536,W=*0) c00c00
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.0 = T31:128:1:44:0x2 1 (TS=,M
Mar  1 16:13:41 server kernel: =1414,W=*0) c01001
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.0 = T31:128:1:64:0x2 1 (TS=,M=1414,W=*0) c01001
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.
Mar  1 16:13:41 server kernel: 0 = 64512:128:1:44:0x2 1 (TS=,M=1414,W=*0) c01001
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.0 = 64512:12
Mar  1 16:13:41 server kernel: 8:1:64:0x2 1 (TS=,M=1414,W=*0) c01001
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.0 = 8192:128:1:44:0x2 1
Mar  1 16:13:41 server kernel: (TS=,M=*0,W=*0) c01001
Mar  1 16:13:41 server kernel: adding osfp Windows NT 4.0 = 8192:128:1:64:0x2 1 (TS=,M=*0,W=*0) c01001
Mar  1 16:13:41 server kernel: adding
Mar  1 16:13:41 server kernel: adding osfp Windows XP SP1 = 
Mar  1 16:13:41 server kernel: %8192:128:1:68:0x403 4 (TS=,M=*0,W=*0) c01801
Mar  1 16:13:41 server kernel: adding osfp Windows 2000  = S20:128:1:48:0x403 4 
Mar  1 16:13:41 server kernel: adding osfp Windows 95 winsock2 = S6:255:1:48:0x403 4 (TS=,M=536,W=*0) c0
Mar  1 16:13:41 server kernel: 0802
Mar  1 16:13:41 server kernel: adding osfp Windows 95 winsock2 = S6:255:1:68:0x403 4 (TS=,M=536,W=*0) c00802

Terri_Kennedy · Mar 2, 2013

IT_Architect said:
What do these entries mean in the /var/log/messages file?

Code:

Mar 1 16:13:41 server kernel: dding osfp FreeBSD 5.2 = 65535:64:1:60:0x10204 6 (TS=,M=*0,W=1) 307400 Mar 1 16:13:41 server kernel: adding osfp FreeBSD 5.0-5.2 = 65535:64:1:60:0x ...

Looks like something having to do with pf(4):

Code:

(0:1) hostname:/boot/kernel# strings pf.ko | grep "adding osfp"
adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d (TS=%s,M=%s%d,W=%s%d) %x

J65nko · Mar 2, 2013

osfp stands for Operating System Finger Print. See http://www.openbsd.org/faq/pf/filter.html#osfp

From pf.conf(5):

Code:

[file]set fingerprints[/file]
	   Load fingerprints of known operating systems from the given file-
	   name.  By default fingerprints of known operating systems are auto-
	   matically loaded from [man=5]pf.os[/man] in /etc but can be overridden via
	   this option.  Setting this option may leave a small period of time
	   where the fingerprints referenced by the currently active ruleset
	   are inconsistent until the new ruleset finishes loading.

IT_Architect · Mar 9, 2013

J65nko said:
osfp stands for Operating System Finger Print. See http://www.openbsd.org/faq/pf/filter.html#osfp

That makes sense.

Thanks tons!

What do these entries mean in the /var/log/messages file?

IT_Architect

Terri_Kennedy

J65nko

IT_Architect