Have you considered matching by vendor class identifier? IIRC for Windows XP it is "MSFT 5.0".<div><br><span></span><div>ŁS<br><br>W dniu piątek, 8 listopada 2013 użytkownik Niall O'Reilly  napisał:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
On 7 Nov 2013, at 16:08, Sten Carlsen wrote:<br>
<br>
> Did you consider nmap?<br>
<br>
        Thanks again for the hint.  It's useful in a different way.<br>
<br>
        Nmap sees only systems which are active during the scan.<br>
        DHCP fingerprinting leaves crumbs for picking up later.<br>
<br>
        A colleague found <a href="http://www.packetfence.org/dhcp_fingerprints.conf" target="_blank">http://www.packetfence.org/dhcp_fingerprints.conf</a><br>
        which is a bit puzzling without some commentary.  Happily, I was<br>
        able to find <a href="http://chatteronthewire.org/download/chatter-dhcp.pdf" target="_blank">http://chatteronthewire.org/download/chatter-dhcp.pdf</a>.<br>
<br>
        I'm now playing with this approach, using the following configuration<br>
        fragment.<br>
<br>
    class "DHCP-FP-WinXP" {<br>
      match option dhcp-parameter-request-list;<br>
      set dhcp-fingerprint = concat(binary-to-ascii(16, 8, ":", hardware), " ", "WinXP");<br>
    }<br>
    subclass "DHCP-FP-WinXP" 01:0f:03:06:2c:2e:2f:1f:21:f9:2b;<br>
    subclass "DHCP-FP-WinXP" 01:0f:03:06:2c:2e:2f:1f:21:f9:2b:fc;<br>
    subclass "DHCP-FP-WinXP" 01:0f:03:06:2c:2e:2f:1f:21:f9:2b:fc:0c;<br>
    subclass "DHCP-FP-WinXP" 0f:03:06:2c:2e:2f:1f:21:f9:2b;<br>
    subclass "DHCP-FP-WinXP" 0f:03:06:2c:2e:2f:1f:21:f9:2b:fc;<br>
    subclass "DHCP-FP-WinXP" 0f:03:06:2c:2e:2f:1f:21:f9:2b:fc:0c;<br>
    subclass "DHCP-FP-WinXP" 1c:02:03:0f:06:0c:2c:2f;<br>
<br>
        ATB<br>
        Niall<br>
<br>
_______________________________________________<br>
dhcp-users mailing list<br>
<a href="javascript:;" onclick="_e(event, 'cvml', 'dhcp-users@lists.isc.org')">dhcp-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/dhcp-users" target="_blank">https://lists.isc.org/mailman/listinfo/dhcp-users</a><br>
</blockquote></div></div><br><br>-- <br><br>"Omnes homines natura scire desiderant"<br>                                           Aristotelis<br>