Methods¶
JA4+ is a set of network fingerprint methods that FoxIO publishes. This library implements eleven of them. This section holds one page for each one.
The two counts, and what each one counts¶
A method is one named JA4+ algorithm. A fingerprinter is the Go type that implements one method or two. The two words count different things, and a reader who applies one count to the other reads the wrong number.
| What is counted | The count | Why |
|---|---|---|
| The methods this library implements | Eleven | The table below names each one. |
| The Go fingerprinter types that carry them | Ten | JA4LFingerprinter writes both JA4L and JA4LS. |
JA4LFingerprinter is the one type that writes two methods. It measures the client
side and the server side of one connection, so one state table serves both. Every other
method reaches one type of its own.
The eleven methods¶
| Method | Page | What it fingerprints | Go type | Type token |
|---|---|---|---|---|
| JA4 | JA4 | One TLS client hello. | JA4Fingerprinter |
ja4 |
| JA4S | JA4S | One TLS server hello. | JA4SFingerprinter |
ja4s |
| JA4H | JA4H | One HTTP request. | JA4HFingerprinter |
ja4h |
| JA4X | JA4X | One X.509 certificate. | JA4XFingerprinter |
ja4x |
| JA4SSH | JA4SSH | One window of SSH packets. | JA4SSHFingerprinter |
ja4ssh |
| JA4L | JA4L | The client latency of one connection. | JA4LFingerprinter |
ja4l |
| JA4LS | JA4LS | The server latency of one connection. | JA4LFingerprinter |
ja4l |
| JA4T | JA4T | One TCP SYN packet. | JA4TFingerprinter |
ja4t |
| JA4TS | JA4TS | One TCP SYN-ACK packet. | JA4TSFingerprinter |
ja4ts |
| JA4D | JA4D | One DHCPv4 message. | JA4DFingerprinter |
ja4d |
| JA4D6 | JA4D6 | One DHCPv6 message. | JA4D6Fingerprinter |
ja4d6 |
JA4L and JA4LS share the Type token ja4l. One fingerprinter writes both, and the
value itself carries the label. The JA4L page states how a caller separates the
two.
What this library does not implement¶
JA4TScan is out of scope, and the reason is that FoxIO publishes nothing to implement.
FoxIO ships no format specification, no image under technical_details/ and no reference
implementation of it. A goal of one answer for one packet cannot be met against a
definition that does not exist. docs/specs/spec.md Non-goals holds the ruling, and the
ruling reverses when FoxIO publishes a format.
FoxIO also names a scanner method, and this project decided nothing about it. The name carries two spellings across the FoxIO records, and FoxIO publishes no format and no implementation for either spelling. This project states no reason, because a stated reason would assert a ruling that no round holds.
Read the FoxIO records before you compare this list to theirs¶
Never read this list as equal to the list that FoxIO names. Three records of the FoxIO
reference name three different sets, at commit
27f0cbf9fd3000c072f82a0f7d0361dc99acf6c8.
| FoxIO record | How many methods it names |
|---|---|
License FAQ.md:5 |
Twelve. |
LICENSE:3 |
Thirteen, and it spells the scanner JA4SScan. |
README.md:293 |
Nine. |
So the sentence "the methods FoxIO names" resolves to three different lists. Every page of this section therefore names what this library implements, and it cites the pinned commit above.
Where the evidence for each page comes from¶
Each method page below states what this library emits today, and it cites two kinds of source.
- The FoxIO transcription.
docs/specs/foxio/holds one file for each FoxIO image, and each file numbers the rules it transcribes. A page that states a part count or a field width cites a rule number of that file. - The Go implementation. A page that states what the library emits names the Go identifier that produces it.
Where a question reaches no answer, the page says so and it names the issue. The maintainer decides a question that the FoxIO implementations split on, and no page of this site decides one.
The license of these methods¶
The site footer states the license of this repository and the license that FoxIO applies. The licensing page holds the full FoxIO terms.