Processors

A processor runs every fingerprinter on each packet and joins the results. It is the entry point most callers use, and the Usage page holds the runnable code.

The two processors

Type	Constructor	What it is for
Processor	NewProcessor	One goroutine. The per-packet path acquires no lock.
SyncProcessor	NewSyncProcessor	Any number of goroutines. One mutex serializes every call.

SyncProcessor exposes no way to reach the inner Processor. A caller who reaches it can break the contract, so the type holds it unexported.

The Concurrency page states which pattern to pick and why. It holds the whole contract, and this page repeats none of it.

The methods

Both types declare the same six methods, and the signatures are identical. So a caller changes one constructor call to move between them.

Method	What it returns	Processor	SyncProcessor
ProcessPacket	The results of one packet, and the non-fatal errors.	link	link
GetShardKey	One routing key for both directions of one connection.	link	link
CloseOpenWindows	The value of the window each fingerprinter holds open.	link	link
CloseConnectionWindow	The value of the window one named connection holds open.	link	link
CleanupConnection	Nothing. It removes the state of one named connection.	link	link
Reset	Nothing. It clears the state of every fingerprinter.	link	link

ProcessPacket returns a slice of errors and not one error. A packet can reach every fingerprinter, so more than one of them can report a non-fatal failure on one packet.

GetShardKey returns an empty string for a packet that carries neither TCP nor UDP, and the caller decides what to do with it.

Three of the six close or drop state, and a reader that skips them loses a value or leaks memory. The Usage page states when to call each one. Two properties that a caller reads here rather than there:

• CloseConnectionWindow removes the connection, so a second call returns an empty slice.
• CloseOpenWindows starts a new window on each connection, so a second call with no packet between the two returns an empty slice.

The one-shot functions

A one-shot function reads one packet through a fingerprinter it builds and discards. It serves a caller that holds no connection state, and it returns the bare value as a string.

Function	Method	Argument
ComputeJA4	JA4	One packet.
ComputeJA4S	JA4S	One packet.
ComputeJA4H	JA4H	One packet.
ComputeJA4T	JA4T	One packet.
ComputeJA4TS	JA4TS	One packet.
ComputeJA4D	JA4D	One packet.
ComputeJA4D6	JA4D6	One packet.
ComputeJA4XFromPacket	JA4X	One packet.
ComputeJA4XFromDER	JA4X	The DER bytes of one certificate.
ComputeJA4XFromPEM	JA4X	The PEM bytes of one certificate.

Each one returns an empty string for a packet that carries no input it reads. It returns no error, so a caller that needs the reason keeps a fingerprinter instead.

Two limits follow from the discarded fingerprinter, and each one changes the value.

• ComputeJA4TS carries no part e. The packet it reads is always the first SYN-ACK of its connection, and part e measures the delays between later ones. A caller that needs part e keeps one JA4TSFingerprinter across the packets of the connection.
• ComputeJA4XFromPacket reassembles no stream. A certificate that spans more than one packet needs JA4XFingerprinter.

JA4L, JA4LS and JA4SSH reach no one-shot function. Each one measures a run of packets, so one packet states nothing.