Skip to content

Fingerprinters

A fingerprinter is the Go type that reads packets and produces the value of one JA4+ method or two. This page indexes each one and the three interfaces a caller asserts against. The Methods section states what each value holds, and it states which type carries which method.

A caller who wants every method at once builds one Processor rather than one fingerprinter at a time.

The types

Each row names the constructor and the type. Read the method page for the value, and read the linked signature for the arguments.

Type Constructor Method page
JA4Fingerprinter NewJA4 JA4
JA4SFingerprinter NewJA4S JA4S
JA4HFingerprinter NewJA4H JA4H
JA4XFingerprinter NewJA4X JA4X
JA4SSHFingerprinter NewJA4SSH JA4SSH
JA4LFingerprinter NewJA4L JA4L and JA4LS
JA4TFingerprinter NewJA4T JA4T
JA4TSFingerprinter NewJA4TS JA4TS
JA4DFingerprinter NewJA4D JA4D
JA4D6Fingerprinter NewJA4D6 JA4D6

One row of that table names two method pages. The Methods overview states the reading, and it states the two counts that a reader must not exchange.

NewJA4SSH takes an argument, and no other constructor does. The Usage page states the argument and the default, and the JA4SSH page states what a window is.

The three methods every fingerprinter carries

Every type above implements Fingerprinter, which declares ProcessPacket, Reset and CleanupConnection. The Usage page states what each one does and when a caller calls it.

A fingerprinter returns a non-fatal error, and it never panics. A packet it cannot read produces no result and one error, so a reader of a malformed capture keeps running.

The two window interfaces

A window is a run of packets that produces one value at its end. JA4SSH holds one, and no other method of this library does. So a caller reaches the value through a type assertion rather than through a method of Fingerprinter.

Interface Its one method When the caller calls it
WindowCloser CloseOpenWindows The packet source ended.
ConnectionWindowCloser CloseConnectionWindow The monitor evicted one connection.

Each interface declares one capability, as http.Flusher and http.Hijacker each do. A type that implements one keeps the dispatch of that one. Processor skips a fingerprinter that implements neither, because such a fingerprinter holds no window open.

Fingerprinter gains no method here, and the reason is the freeze. A new method on an exported interface breaks every third-party implementation, which v1.0.0 forbids for the whole v1 series.

One fingerprinter serves one goroutine

Every type on this page holds state that no lock guards. Two goroutines that share one fingerprinter write a data race, and the race detector reports it. The library does not detect it at run time.

The Concurrency page states the two patterns that reach more than one goroutine, and it holds the runnable code for each one.

The JA4SSH extra method

GetHASSHFingerprints returns the HASSH values that the SSH handshakes produced. HASSH is not a JA4+ method, and Types and helpers indexes the result type.