Personalities Every packet generated by Honeyd passes through the personality engine. Introduces operating system specific quirks into the packets for nmap/xprobe identification. Personalities are defined via Nmap fingerprint file: Tseq is the TCP sequenceability test T1 is a SYN packet with a bunch of TCP options to open port T2 is a NULL packet w/options to open port T3 is a SYN|FIN|URG|PSH packet w/options to open port T4 is an ACK to open port w/options T5 is a SYN to closed port w/options T6 is an ACK to closed port w/options T7 is a FIN|PSH|URG to a closed port w/options PU is a UDP packet to a closed port Lookup behavior of configured personality.