JA4+™ Network Fingerprinting

JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for threat actors, malware detection, session hijacking prevention, compliance automation, location tracking, DDoS detection, grouping of threat actors, reverse shell detection, and many more.

For a quick explainer on JA4+ and to use as a reference during analysis see:
JA4+ Cheat Sheet

For in-depth detail, please read our blogs on how JA4+ works, why it works, and examples of what can be detected/prevented with it:
JA4+ Network Fingerprinting (JA4/S/H/L/X/SSH)
JA4T: TCP Fingerprinting (JA4T/TS/TScan)
Investigating Surfshark and NordVPN with JA4T (JA4T)
JA4D and JA4D6: DHCP Fingerprinting (JA4D/6)

If you love JA4+, consider getting a t-shirt or hoodie:
JA4+ Shirts, Hoodies, and Stickers

Table of contents

• Current methods and implementation details
• Implementations
• Tools that support JA4+
• Examples
• Plugins
• Binaries
  • Release Assets
  • Installing tshark
    • Linux
    • macOS
    • Windows
  • Running JA4+
• Database
• Release Process
  • How to Create a Release
• JA4+ Details
• Licensing
• Q&A
• JA4+ was created by

Current methods and implementation details

Full Name	Short Name	Description
JA4	JA4	TLS Client Fingerprinting
JA4Server	JA4S	TLS Server Response / Session Fingerprinting
JA4HTTP	JA4H	HTTP Client Fingerprinting
JA4Latency	JA4L	Client to Server Latency Measurment / Light Distance
JA4LatencyServer	JA4LS	Server to Client Latency Measurement / Light Distance
JA4X509	JA4X	X509 TLS Certificate Fingerprinting
JA4SSH	JA4SSH	SSH Traffic Fingerprinting
JA4TCP	JA4T	TCP Client Fingerprinting
JA4TCPServer	JA4TS	TCP Server Response Fingerprinting
JA4TCPScan	JA4TScan	Active TCP Fingerprint Scanner
JA4DHCP	JA4D	DHCP Fingerprinting
JA4DHCPv6	JA4D6	DHCPv6 Fingerprinting
JA4NTP	JA4N	NTP Fingerprinting
JA4Scan-TLS	JA4Scan-TLS	Active TLS Server Fingerprint Scanner
JA4Scan-QUIC	JA4Scan-QUIC	Active QUIC Server Fingerprint Scanner

The full name or short name can be used interchangeably. Additional JA4+ methods are in the works...

To understand how to read JA4+ fingerprints, see Technical Details

Implementations

This repo includes JA4+ in

• Python
• Rust
• C, as a Wireshark plugin.
• Zeek

Tools that support JA4+