Skip to content

Types and helpers

This page indexes every exported name that is neither a fingerprinter nor a processor. Fingerprinters and Processors hold the other two groups.

The result types

Type What holds it
FingerprintResult Every ProcessPacket call and every window close returns a slice of it.
HASSHResult JA4SSHFingerprinter.GetHASSHFingerprints returns a slice of it.
SSHSessionInfo InterpretJA4SSH returns one.

The output schema page states every field of FingerprintResult and what it holds. This page names the type and links the signature, and it repeats no field.

HASSH is not a JA4+ method. It is a separate SSH fingerprint that the SSH handshake produces, and this library reports it beside JA4SSH.

The key log

A key log holds the TLS secrets that decrypt a capture. The library reads a secret only when the caller supplies one, and it reads no key material outside the reader the caller passes.

Name What it is
KeyLog The secrets of one or more connections. The client random identifies each one.
ParseKeyLog Reads a key log in the NSS key log format.
ReadKeyLogFromCapture Reads the Decryption Secrets Blocks of a pcapng capture.
KeyLog.Secret Returns the secret of one label for one connection.
KeyLog.ClientRandoms Returns the client random of every connection, sorted.
KeyLog.Len Returns the count of secrets.
ErrNoSecret Reports that no secret is available for the connection.

A KeyLog does not change after the constructor returns, so any number of goroutines read one. It is the one exported type of this library that more than one goroutine may share without a mutex.

ErrNoSecret reaches two callers. One supplied no key log, and one supplied a key log that holds no secret for the connection. Compare it with errors.Is.

The QUIC decryption function

DecryptQUICPacket returns the frame bytes of one QUIC packet that a secret protects. KeyLog.Secret returns that secret.

  • A long header packet carries its own lengths, so it ignores the connection identifier length the caller passes.
  • A short header packet does not, so the caller states the Destination Connection ID length.
  • It returns ErrNoSecret when the caller supplies no secret, and it produces no fingerprint in that case.

RFC 9001 Section 5.1 states the key derivation, and Section 5.4.1 states the header protection.

The database lookup

The lookup maps a fingerprint to the application that produces it. The Usage page states which function reaches the network and which one does not.

Name What it is
LookupResult The record the mapping table holds for one fingerprint.
LookupFingerprint Reads the local mapping table. It performs no network call.
DatabaseInfo The source, the path, the entry count and the modification time of the active table.
GetDatabaseInfo Returns the DatabaseInfo of the active table.
CachedDatabasePath Returns the path of the cached mapping file, and it creates the directory.

Each name above lives in the ja4plus package, and none of them reaches the network.

The remote lookup lives in ja4db

The remote lookup is a package of its own, at github.com/Crank-Git/ja4plus-go/ja4db. The maintainer ruled the network boundary on 2026-08-14, so the ja4plus package imports no HTTP client.

Name What it is
LookupFingerprintRemote Reads a remote endpoint. The caller opts in with a context and a config.
RemoteLookupConfig The endpoint and the HTTP client of a remote lookup.

LookupFingerprintRemote returns a *ja4plus.LookupResult, so a caller who reads both the local table and the remote endpoint handles one result type.

LookupFingerprint returns nil for a fingerprint the table does not hold. LookupFingerprintRemote returns nil and nil for that same case. It returns nil and an error for each of these.

  • A transport failure.
  • A status other than 200.
  • A body it cannot decode.

The interpretation helpers

Each function below reads a value and estimates something about the endpoint. An estimate is not a fingerprint, and no FoxIO vector holds one.

Function What it estimates
InterpretJA4SSH The session type of one JA4SSH value. It returns nil for a value it cannot read.
LookupHASSH The name of a known HASSH fingerprint. It returns an empty string for an unknown one.
EstimateOS The operating system, from the observed time-to-live.
EstimateHopCount The hop count, from the observed time-to-live.
CalculateDistance The distance in miles, from a one-way latency.
CalculateDistanceKm The distance in kilometers, from a one-way latency.

No fingerprint value of this library reads one of these functions. The JA4LS page states that part b writes the observed time-to-live and that no branch computes a hop count. A caller that wants an estimate calls the function itself.