Skip to content

Normalize TLS fields and harden JA4 parsing #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vlvkobal merged 2 commits into from
Jan 29, 2026
Merged

Normalize TLS fields and harden JA4 parsing #280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c6b626
Normalize ciphers in Python implementation
vlvkobal Jan 27, 2026
83a2de7
Update golden files
vlvkobal Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 37 additions & 1 deletion python/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,42 @@
'0x8a8a': True, '0x9a9a': True, '0xaaaa': True, '0xbaba': True,
'0xcaca': True, '0xdada': True, '0xeaea': True, '0xfafa': True}

def _parse_tls_int(value):
if isinstance(value, int):
return value
s = str(value).strip().lower()
if s.startswith('0x'):
return int(s, 16)
if any(ch in 'abcdef' for ch in s):
return int(s, 16)
return int(s)

def normalize_tls_list(values, width=4, prefix='0x'):
if values is None:
return []
if not isinstance(values, list):
values = [values]
return [ f"{prefix}{_parse_tls_int(v):0{width}x}" for v in values ]

def normalize_tls_value(value, width=4, prefix='0x'):
values = normalize_tls_list(value, width, prefix)
return values[0] if values else None

def normalize_tls_fields(packet, extensions_prefix='0x'):
if not packet:
return packet
if 'extensions' in packet:
packet['extensions'] = normalize_tls_list(packet['extensions'], prefix=extensions_prefix)
if 'ciphers' in packet:
packet['ciphers'] = normalize_tls_list(packet['ciphers'])
if 'supported_versions' in packet:
packet['supported_versions'] = normalize_tls_list(packet['supported_versions'])
if 'version' in packet:
packet['version'] = normalize_tls_value(packet['version'])
if 'signature_algorithms' in packet:
packet['signature_algorithms'] = normalize_tls_list(packet['signature_algorithms'])
return packet

def delete_keys(keys, x):
for key in keys:
if key in x:
Expand Down Expand Up @@ -172,5 +208,5 @@ def get_signature_algorithms(packet):
except Exception as e:
pass
packet['signature_algorithms'] = packet['signature_algorithms'][alg_lengths[idx]:]
return [ x for x in packet['signature_algorithms'] if x not in GREASE_TABLE ]
return [ x for x in packet.get('signature_algorithms', []) if x not in GREASE_TABLE ]

6 changes: 3 additions & 3 deletions python/ja4.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,8 +177,8 @@ def to_ja4s(x, debug_stream):
if 'ciphers' not in x:
x['ciphers'] = []

normalize_tls_fields(x, extensions_prefix='')
# get extensions in hex in the order they are present (include grease values)
x['extensions'] = [ '{:04x}'.format(int(k)) for k in x['extensions'] ]
ext_len = '{:02d}'.format(min(len(x['extensions']), 99))

if x['extensions']:
Expand All @@ -187,7 +187,7 @@ def to_ja4s(x, debug_stream):
extensions = '000000000000'

# only one cipher for ja4s
x['ciphers'] = x['ciphers'][2:]
x['ciphers'] = x['ciphers'][0][2:] if x['ciphers'] else ''

x['version'] = x['version'][0] if isinstance(x['version'], list) else x['version']
if 'supported_versions' in x:
Expand Down Expand Up @@ -224,7 +224,7 @@ def to_ja4(x, debug_stream):
if 'ciphers' not in x:
x['ciphers'] = []

x['extensions'] = [ '0x{:04x}'.format(int(k)) for k in x['extensions'] ]
normalize_tls_fields(x, extensions_prefix='0x')
ext_len = '{:02d}'.format(min(len([ x for x in x['extensions'] if x not in GREASE_TABLE]), 99))
cache_update(x, 'client_ciphers', x['ciphers'], debug_stream)

Expand Down
10 changes: 5 additions & 5 deletions python/test/testdata/badcurveball.pcap.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
"JA4L-S": "781_238",
"JA4L-C": "2181_64",
"domain": "bad.curveballtest.com",
"JA4.1": "t00d1715h2_dd2c26892b57_8201b1be11a4",
"JA4_r.1": "t00d1715h2_,,,171,172,195,196,199,200,392,393,6,65,66,67,690,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,ff01_27,52,25,83,53,81,54,37,3",
"JA4_o.1": "t00d1715h2_6c4ba73770eb_4848efb2a220",
"JA4_ro.1": "t00d1715h2_690,65,66,67,195,199,196,200,393,392,171,172,6,7,,,_0000,0017,ff01,000a,000b,0023,0010,0005,000d,0012,0033,002d,002b,001b,0015_27,52,25,83,53,81,54,37,3",
"JA4S": "t0005h1_195_845f7282a956",
"JA4.1": "t13d1615h2_46e7e9700bed_45f260be83e2",
"JA4_r.1": "t13d1615h2_000a,002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201",
"JA4_o.1": "t13d1615h2_45f31bb0a5cc_b0e5d31d5128",
"JA4_ro.1": "t13d1615h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035,000a_0000,0017,ff01,000a,000b,0023,0010,0005,000d,0012,0033,002d,002b,001b,0015_0403,0804,0401,0503,0805,0501,0806,0601,0201",
"JA4S": "t1205h1_c02b_845f7282a956",
"JA4X.1": "2e9214a636bc_a373a9f83c6b_0e17604154c5",
"JA4X.2": "2e9214a636bc_2e9214a636bc_795797892f9c"
}
Expand Down
28 changes: 14 additions & 14 deletions python/test/testdata/browsers-x509.pcapng.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@
"JA4L-S": "1907_112",
"JA4L-C": "278_128",
"domain": "edge.microsoft.com",
"JA4.1": "t00d1616h2_4109672baa2e_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,392,393,6,65,66,67,690,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_0200e8047a78_8a0afe6f3afd",
"JA4_ro.1": "t00d1616h2_690,65,66,67,195,199,196,200,393,392,171,172,6,7,,_000d,0000,000a,0005,000b,002b,001b,ff01,0033,4469,002d,0023,0017,0012,0010,0015_27,52,25,83,53,81,54,37",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_4237572e953b",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_000d,0000,000a,0005,000b,002b,001b,ff01,0033,4469,002d,0023,0017,0012,0010,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4X.1": "a373a9f83c6b_2bab15409345_0f2217ba412e",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_c34b04c10969"
},
Expand All @@ -28,11 +28,11 @@
"JA4L-S": "7166_41",
"JA4L-C": "349_128",
"domain": "nym1-ib.adnxs.com",
"JA4.1": "t00d1616h2_c4e216e269f4_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,354,392,393,6,65,66,67,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_00d8772d9166_548bd83a577c",
"JA4_ro.1": "t00d1616h2_354,65,66,67,195,199,196,200,393,392,171,172,6,7,,_002b,4469,000b,0017,000d,0000,001b,0005,0033,ff01,0010,000a,002d,0012,0023,0015_27,52,25,83,53,81,54,37",
"JA4S": "t0007h2_195_cf25e267ce22",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_2da480b6a2c8",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_002b,4469,000b,0017,000d,0000,001b,0005,0033,ff01,0010,000a,002d,0012,0023,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t1207h2_c02b_cf25e267ce22",
"JA4X.1": "7d5dbb3783b4_2bab15409345_7bf9a7bf7029",
"JA4X.2": "7d5dbb3783b4_7d5dbb3783b4_44440d41940c"
},
Expand All @@ -47,11 +47,11 @@
"JA4L-S": "2948_229",
"JA4L-C": "247_128",
"domain": "lptag.liveperson.net",
"JA4.1": "t00d1616h2_73d9d18e4e10_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,018,171,172,195,196,199,200,392,393,6,65,66,67,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_828fc7e24cd3_0069bd55eedf",
"JA4_ro.1": "t00d1616h2_018,65,66,67,195,199,196,200,393,392,171,172,6,7,,_0000,0033,0010,0017,ff01,0012,002b,000d,000a,002d,0005,0023,000b,4469,001b,0015_27,52,25,83,53,81,54,37",
"JA4S": "t0005h2_199_845f7282a956",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_c4528f9c0199",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_0000,0033,0010,0017,ff01,0012,002b,000d,000a,002d,0005,0023,000b,4469,001b,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t1205h2_c02f_845f7282a956",
"JA4X.1": "2bab15409345_2e9214a636bc_b891c0ad6f32",
"JA4X.2": "2bab15409345_2bab15409345_2367ce7fbc5b",
"JA4X.3": "2bab15409345_2bab15409345_2030e37f3421"
Expand Down
10 changes: 5 additions & 5 deletions python/test/testdata/chrome-cloudflare-quic-with-secrets.pcapng.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
"JA4L-S": "5749_56",
"JA4L-C": "149_64",
"domain": "cloudflare-quic.com",
"JA4.1": "t00d1616h2_06835249484a_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,392,393,6,65,66,67,7,802_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_572e68ba0241_ac2009940b69",
"JA4_ro.1": "t00d1616h2_802,65,66,67,195,199,196,200,393,392,171,172,6,7,,_0000,0017,ff01,000a,000b,0023,0010,0005,000d,0012,0033,002d,002b,001b,4469,0015_27,52,25,83,53,81,54,37",
"JA4S": "t000200_65_234ea6891581",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_2d79a7d73c2f",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_0000,0017,ff01,000a,000b,0023,0010,0005,000d,0012,0033,002d,002b,001b,4469,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t130200_1301_234ea6891581",
"JA4X.1": "a373a9f83c6b_2bab15409345_7bf9a7bf7029",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_44440d41940c"
},
Expand Down
10 changes: 5 additions & 5 deletions python/test/testdata/http2-with-cookies.pcapng.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
"JA4L-S": "44840_117",
"JA4L-C": "470_128",
"domain": "youtube.com",
"JA4.1": "t00d1616h2_73d9d18e4e10_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,018,171,172,195,196,199,200,392,393,6,65,66,67,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_828fc7e24cd3_ca0d6ae205f6",
"JA4_ro.1": "t00d1616h2_018,65,66,67,195,199,196,200,393,392,171,172,6,7,,_002d,0012,0000,000b,4469,001b,ff01,0033,000d,0010,0005,000a,0017,002b,0023,0015_27,52,25,83,53,81,54,37",
"JA4S": "t000200_65_234ea6891581",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_e0fccb203dfb",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_002d,0012,0000,000b,4469,001b,ff01,0033,000d,0010,0005,000a,0017,002b,0023,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t130200_1301_234ea6891581",
"JA4X.1": "a373a9f83c6b_7022c563de38_2e3757343cb0",
"JA4X.2": "a373a9f83c6b_a373a9f83c6b_5d71497f7704",
"JA4X.3": "7d5dbb3783b4_a373a9f83c6b_2fbee3f04f3b"
Expand Down
10 changes: 5 additions & 5 deletions python/test/testdata/ipv6.pcapng.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
"JA4L-S": "18861_59",
"JA4L-C": "3911_64",
"domain": "www.cloudflare.com",
"JA4.1": "t00d4605h2_e9b8aa14296f_2bafe05263c3",
"JA4_r.1": "t00d4605h2_,,,,,,,,,,,,0,159,160,161,162,169,170,171,172,187,188,191,192,195,196,199,2,2,200,3,392,393,394,413,5,6,6,6,6,7,7,8,9,9_000a,000b,000d_37,39,423,81,83,25,27,166,909,9,1,3,5",
"JA4_o.1": "t00d4605h2_463625df507c_6af77b7964cc",
"JA4_ro.1": "t00d4605h2_200,196,192,188,172,162,9,7,,393,392,394,413,6,6,9,7,,,2,2,199,195,191,187,171,161,8,3,,0,,6,,,6,,169,159,,,170,160,,,5_0000,000b,000a,000d,0010_37,39,423,81,83,25,27,166,909,9,1,3,5",
"JA4S": "t0004h2_393_1428ce7b4018",
"JA4.1": "t12d4605h2_85626a9a5f7f_aaf95bb78ec9",
"JA4_r.1": "t12d4605h2_0004,0005,000a,0016,002f,0033,0035,0039,003c,003d,0041,0045,0067,006b,0081,0084,0088,009c,009d,009e,009f,00ba,00be,00c0,00c4,00ff,c007,c008,c009,c00a,c011,c012,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,cca8,cca9,ccaa,ff85_000a,000b,000d_0601,0603,efef,0501,0503,0401,0403,eeee,eded,0301,0303,0201,0203",
"JA4_o.1": "t12d4605h2_644f5d117d98_094daec7ec8d",
"JA4_ro.1": "t12d4605h2_c030,c02c,c028,c024,c014,c00a,009f,006b,0039,cca9,cca8,ccaa,ff85,00c4,0088,0081,009d,003d,0035,00c0,0084,c02f,c02b,c027,c023,c013,c009,009e,0067,0033,00be,0045,009c,003c,002f,00ba,0041,c011,c007,0005,0004,c012,c008,0016,000a,00ff_0000,000b,000a,000d,0010_0601,0603,efef,0501,0503,0401,0403,eeee,eded,0301,0303,0201,0203",
"JA4S": "t1204h2_cca9_1428ce7b4018",
"JA4X.1": "7d5dbb3783b4_ba7ce0880c07_7bf9a7bf7029",
"JA4X.2": "7d5dbb3783b4_7d5dbb3783b4_41a019652939"
}
Expand Down
46 changes: 23 additions & 23 deletions python/test/testdata/latest.pcapng.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@
"JA4L-S": "33804_227",
"JA4L-C": "513_128",
"domain": "pdx-col.eum-appdynamics.com",
"JA4.1": "t00d1616h2_4057d54ba945_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,392,393,6,65,66,67,7,906_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_faec7b756048_4ff83ae3fc4f",
"JA4_ro.1": "t00d1616h2_906,65,66,67,195,199,196,200,393,392,171,172,6,7,,_0023,ff01,0000,001b,0012,4469,002d,002b,000d,0010,0033,000a,0005,0017,000b,0015_27,52,25,83,53,81,54,37",
"JA4S": "t0006h2_199_3603f09c43ba",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_9aeef56da6aa",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_0023,ff01,0000,001b,0012,4469,002d,002b,000d,0010,0033,000a,0005,0017,000b,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t1206h2_c02f_3603f09c43ba",
"JA4X.1": "a373a9f83c6b_2bab15409345_7bf9a7bf7029",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_a83ffcd6e6c2"
},
Expand All @@ -29,11 +29,11 @@
"JA4L-S": "7096_245",
"JA4L-C": "449_128",
"domain": "discovery.cem.cloud.us",
"JA4.1": "t00d190800_4d06a43e2d88_5027fbe6a38d",
"JA4_r.1": "t00d190800_,,,,,161,162,171,172,187,188,191,192,195,196,199,200,6,7_0005,000a,000b,000d,0017,0023,ff01_52,53,54,25,81,3,27,83,5,4,37,39",
"JA4_o.1": "t00d190800_be9ffe69a4f5_d558bccac42c",
"JA4_ro.1": "t00d190800_196,195,200,199,188,187,192,191,162,161,172,171,7,6,,,,,_0000,0005,000a,000b,000d,0023,0017,ff01_52,53,54,25,81,3,27,83,5,4,37,39",
"JA4S": "t000600_199_51ad275821ba",
"JA4.1": "t12d190800_d83cc789557e_7af1ed941c26",
"JA4_r.1": "t12d190800_000a,002f,0035,003c,003d,009c,009d,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030_0005,000a,000b,000d,0017,0023,ff01_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603",
"JA4_o.1": "t12d190800_e8d5f427a2c5_5e98404dd3cc",
"JA4_ro.1": "t12d190800_c02c,c02b,c030,c02f,c024,c023,c028,c027,c00a,c009,c014,c013,009d,009c,003d,003c,0035,002f,000a_0000,0005,000a,000b,000d,0023,0017,ff01_0804,0805,0806,0401,0501,0201,0403,0503,0203,0202,0601,0603",
"JA4S": "t120600_c02f_51ad275821ba",
"JA4X.1": "a373a9f83c6b_2bab15409345_7bf9a7bf7029",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_a83ffcd6e6c2"
},
Expand All @@ -56,10 +56,10 @@
"JA4L-S": "42103_109",
"JA4L-C": "513_128",
"domain": "ping-edge.smartscreen.microsoft.com",
"JA4.1": "t00d1616h2_c4e216e269f4_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,354,392,393,6,65,66,67,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_00d8772d9166_7cabee5c7374",
"JA4_ro.1": "t00d1616h2_354,65,66,67,195,199,196,200,393,392,171,172,6,7,,_000b,0023,002d,001b,000d,ff01,0012,0005,002b,0017,0000,0010,4469,000a,0033,0015_27,52,25,83,53,81,54,37",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_ee5437a6a04b",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_000b,0023,002d,001b,000d,ff01,0012,0005,002b,0017,0000,0010,4469,000a,0033,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4X.1": "a373a9f83c6b_2bab15409345_0f2217ba412e",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_c34b04c10969"
},
Expand All @@ -74,10 +74,10 @@
"JA4L-S": "53595_109",
"JA4L-C": "487_128",
"domain": "data-edge.smartscreen.microsoft.com",
"JA4.1": "t00d1616h2_73d9d18e4e10_bed3546ee6f4",
"JA4_r.1": "t00d1616h2_,,018,171,172,195,196,199,200,392,393,6,65,66,67,7_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_828fc7e24cd3_e87b6a2ca453",
"JA4_ro.1": "t00d1616h2_018,65,66,67,195,199,196,200,393,392,171,172,6,7,,_0023,0000,000a,0033,001b,0005,ff01,000d,0017,4469,0010,002b,000b,0012,002d,0015_27,52,25,83,53,81,54,37",
"JA4.1": "t13d1516h2_8daaf6152771_e5627efa2ab1",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,0023,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_7b772b20e97b",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_0023,0000,000a,0033,001b,0005,ff01,000d,0017,4469,0010,002b,000b,0012,002d,0015_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4X.1": "a373a9f83c6b_2bab15409345_0f2217ba412e",
"JA4X.2": "7d5dbb3783b4_a373a9f83c6b_c34b04c10969"
},
Expand All @@ -92,11 +92,11 @@
"JA4L-S": "14207_43",
"JA4L-C": "188_128",
"domain": "app.slack.com",
"JA4.1": "t00d1616h2_7ea02c1142d5_811abd909fb7",
"JA4_r.1": "t00d1616h2_,,171,172,195,196,199,200,392,393,6,65,66,67,7,70_0005,000a,000b,000d,0012,0017,001b,0023,0029,002b,002d,0033,4469,ff01_27,52,25,83,53,81,54,37",
"JA4_o.1": "t00d1616h2_8b75d945926f_5f27f96077ac",
"JA4_ro.1": "t00d1616h2_70,65,66,67,195,199,196,200,393,392,171,172,6,7,,_000d,0010,0000,000b,0023,4469,ff01,0033,000a,002d,002b,0005,0017,0012,001b,0029_27,52,25,83,53,81,54,37",
"JA4S": "t000300_65_6bbbaf601ed8"
"JA4.1": "t13d1516h2_8daaf6152771_9b887d9acb53",
"JA4_r.1": "t13d1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001b,0023,0029,002b,002d,0033,4469,ff01_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4_o.1": "t13d1516h2_acb858a92679_ff8ca026d952",
"JA4_ro.1": "t13d1516h2_1301,1302,1303,c02b,c02f,c02c,c030,cca9,cca8,c013,c014,009c,009d,002f,0035_000d,0010,0000,000b,0023,4469,ff01,0033,000a,002d,002b,0005,0017,0012,001b,0029_0403,0804,0401,0503,0805,0501,0806,0601",
"JA4S": "t130300_1301_6bbbaf601ed8"
},
{
"stream": 6,
Expand Down
Loading