Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python ja4 shows incorrect fingerprint for some streams #183

Open
noeltimothy opened this issue Nov 6, 2024 · 0 comments
Open

Python ja4 shows incorrect fingerprint for some streams #183

noeltimothy opened this issue Nov 6, 2024 · 0 comments
Assignees

Comments

@noeltimothy
Copy link
Collaborator

While processing large pcaps, Tshark seems to be sending duplicates of the same stream data.
In once case, (attached tls-sni.pcapng), we observed that stream 38 had an incorrect fingerprint. This was because, the stream initially came in with all extensions but Tshark records the same stream a second time. At the second recording, one of the extensions is missed out causing the fingerprint to be wrong.

Bad fingerprint..

    {
        "stream": 38,
        "src": "192.168.1.168",
        "dst": "13.107.237.40",
        "srcport": "50159",
        "dstport": "443",
        "domain": "mem.gfx.ms",
        "JA4": "t13d1515h2_8daaf6152771_f37e75b10bcc"
    },

It should be the following instead

t13d1515h2_8daaf6152771_e5627efa2ab1
@noeltimothy noeltimothy self-assigned this Nov 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant