# INSTALL#
# copy p0f-analyzer.cf p0f-analyzer.pm to /etc/mail/spamassassin
# add "loadplugin p0f /etc/mail/spamassassin/p0f-analyzer.pm" in any *.pre files
# under /etc/mail/spamassassin directory 

use_p0f 1 
p0f_host 127.0.0.1
p0f_port 2345

header L_P0F_WXP   X-P0f-OS-Fingerprint =~ /^Windows XP(?![^(]*\b2000 SP)/
describe L_P0F_WXP       Relayed through Windows XP
score  L_P0F_WXP  1.0

header L_P0F_W     X-P0f-OS-Fingerprint =~ /^Windows(?! XP)/
describe L_P0F_W       Relayed through Windows OS except Windows XP
score  L_P0F_W     0.1

header L_P0F_UNKN  X-P0f-OS-Fingerprint =~ /^UNKNOWN/
describe L_P0F_UNKN       Relayed through unknown OS
score  L_P0F_UNKN  0.8

header L_P0F_Unix  X-P0f-OS-Fingerprint =~ /^((Free|Open|Net)BSD)|Solaris|HP-UX|Tru64/
describe L_P0F_Unix       Relayed through Unix OS
score  L_P0F_Unix  -1.0

header L_P0F_D1234 X-P0f-OS-Fingerprint =~ /\bdistance [1-4](?![0-9])/
header L_P0F_D5    X-P0f-OS-Fingerprint =~ /\bdistance 5(?![0-9])/
header L_P0F_D6    X-P0f-OS-Fingerprint =~ /\bdistance 6(?![0-9])/
header L_P0F_D7    X-P0f-OS-Fingerprint =~ /\bdistance 7(?![0-9])/
header L_P0F_D8    X-P0f-OS-Fingerprint =~ /\bdistance 8(?![0-9])/
header L_P0F_D9    X-P0f-OS-Fingerprint =~ /\bdistance 9(?![0-9])/
header L_P0F_D10   X-P0f-OS-Fingerprint =~ /\bdistance 10(?![0-9])/
header L_P0F_D11   X-P0f-OS-Fingerprint =~ /\bdistance 11(?![0-9])/
score  L_P0F_D1234 -0.5
score  L_P0F_D5    -0.5
score  L_P0F_D6    -0.5
score  L_P0F_D7    -0.5
score  L_P0F_D8    -0.5
score  L_P0F_D9    -0.4
score  L_P0F_D10   -0.3
score  L_P0F_D11   -0.3