What is JA4 TLS fingerprinting?

When a program opens a TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. connection, its first message lists the versions, ciphers and extensions it supports, in a characteristic order. A fingerprint such as JA4 condenses that message into a short string, so the same client software can be recognised across connections without decrypting anything. It helps spot unusual clients, such as a script posing as a browser. NetSenX computes TLS fingerprints from the handshake from the Starter plan, with its own implementation. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port, not in the basic mode used on macOS.

← All 40 questions on Encryption and encrypted trafficAll topics