--- p0f-query.c.orig 2006-03-09 13:24:19.000000000 -0600 +++ p0f-query.c 2006-06-23 14:39:50.000000000 -0500 @@ -113,8 +113,10 @@ struct cache_data* cur = *c + SUBMOD(cur_c-i,QUERY_CACHE); if (cur->sad == q->src_ad && - cur->dad == q->dst_ad && - cur->ports == (q->src_port << 16) + q->dst_port) { + (cur->dad == q->dst_ad || q->dst_ad == 0) && + ((cur->ports == (q->src_port << 16) + q->dst_port) || + (q->src_port == 0 && cur->ports & 0xff == q->dst_port) || + (q->src_port == 0 && q->dst_port == 0))) { struct p0f_response* n = &cur->s; n->magic = QUERY_MAGIC; n->type = RESP_OK;