In the Python code for JA4, lines 456 and 461, there is a system call to tshark. In this call, there is no -n, which would inform tshark to not perform domain name resolution. By default, tshark will perform domain name resolution, so in its current implementation, JA4 is performing domain name resolution. This is a massive slow-down and should be remedied if domain name resolution is unnecessary. For example, in line 461, the code could be changed:
This change will result in a massive increase in processing speed. When I tested the speed difference, I used a PCAP file with 90979 packets. When I used the default settings in ja4.py, the processing took over 100 seconds (measured using bash time command; I killed the process after 100 seconds), while after making the suggested change on line 461 (shown above), the processing took about 22 seconds.
If reverse DNS is unnecessary, this should be changed, but if it's necessary, you can close this issue.
In the Python code for JA4, lines 456 and 461, there is a system call to
tshark. In this call, there is no-n, which would informtsharkto not perform domain name resolution. By default,tsharkwill perform domain name resolution, so in its current implementation, JA4 is performing domain name resolution. This is a massive slow-down and should be remedied if domain name resolution is unnecessary. For example, in line 461, the code could be changed:This change will result in a massive increase in processing speed. When I tested the speed difference, I used a PCAP file with 90979 packets. When I used the default settings in
ja4.py, the processing took over 100 seconds (measured using bashtimecommand; I killed the process after 100 seconds), while after making the suggested change on line 461 (shown above), the processing took about 22 seconds.If reverse DNS is unnecessary, this should be changed, but if it's necessary, you can close this issue.