Fingerprinters¶
A fingerprinter is the Go type that reads packets and produces the value of one JA4+ method or two. This page indexes each one and the three interfaces a caller asserts against. The Methods section states what each value holds, and it states which type carries which method.
A caller who wants every method at once builds one Processor rather
than one fingerprinter at a time.
The types¶
Each row names the constructor and the type. Read the method page for the value, and read the linked signature for the arguments.
One row of that table names two method pages. The Methods overview states the reading, and it states the two counts that a reader must not exchange.
NewJA4SSH takes an argument, and no other constructor does. The
Usage page states the argument
and the default, and the JA4SSH page states what a window is.
The three methods every fingerprinter carries¶
Every type above implements
Fingerprinter, which
declares ProcessPacket, Reset and CleanupConnection. The
Usage page states what each one
does and when a caller calls it.
A fingerprinter returns a non-fatal error, and it never panics. A packet it cannot read produces no result and one error, so a reader of a malformed capture keeps running.
The two window interfaces¶
A window is a run of packets that produces one value at its end. JA4SSH holds one, and
no other method of this library does. So a caller reaches the value through a type
assertion rather than through a method of Fingerprinter.
| Interface | Its one method | When the caller calls it |
|---|---|---|
WindowCloser |
CloseOpenWindows |
The packet source ended. |
ConnectionWindowCloser |
CloseConnectionWindow |
The monitor evicted one connection. |
Each interface declares one capability, as http.Flusher and http.Hijacker each do.
A type that implements one keeps the dispatch of that one. Processor skips a
fingerprinter that implements neither, because such a fingerprinter holds no window open.
Fingerprinter gains no method here, and the reason is the freeze. A new method on an
exported interface breaks every third-party implementation, which v1.0.0 forbids for the
whole v1 series.
One fingerprinter serves one goroutine¶
Every type on this page holds state that no lock guards. Two goroutines that share one fingerprinter write a data race, and the race detector reports it. The library does not detect it at run time.
The Concurrency page states the two patterns that reach more than one goroutine, and it holds the runnable code for each one.
The JA4SSH extra method¶
GetHASSHFingerprints
returns the HASSH values that the SSH handshakes produced. HASSH is not a JA4+ method, and
Types and helpers indexes the result type.