# What is JA4 TLS fingerprinting?

When a program opens a TLS connection, its first message lists the versions, ciphers and extensions it supports, in a characteristic order. A fingerprint such as JA4 condenses that message into a short string, so the same client software can be recognised across connections without decrypting anything. It helps spot unusual clients, such as a script posing as a browser. NetSenX computes TLS fingerprints from the handshake from the Starter plan, with its own implementation. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-ja4-tls-fingerprinting

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is the difference between JA3 and JA4?](https://netsenx.com/en/faq/what-is-the-difference-between-ja3-and-ja4)
- [What is SNI, and why does it matter for monitoring?](https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring)
- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)
- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)
- [Do QUIC and HTTP/3 blind firewalls?](https://netsenx.com/en/faq/do-quic-and-http3-blind-firewalls)