What are the tools for analyzing suspicious traffic (OS)?

Question

linux

Actually, the task is to distinguish potentially synthetic traffic. Specifically, those who emulate mobile devices are of interest (ie, determine the user's OS by tcp packets).
There is p0f, but it is already ancient, the signatures are old, and it’s not very convenient to write this canvas to the database that it throws out (
Maybe someone uses more convenient and newer tools?

Answer 1

https://suricata-ids.org

Answer 2

https://www.snort.org