The pessimistic case is when the attack signature matches exactly the signature of real operating system. For example, if the attack resembles Linux, with the p

The pessimistic case is when the attack signature matches exactly the signature of real operating system. For example, if the attack resembles Linux, with the p0f-to-BPF you can generate a BPF that matches Linux SYN packets. This allows you to block these packets, and this of course can affect traffic from Linux machines.