FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
989 stars 85 forks source link

Zeek: fix ja4_c with no signature algorithms #149

Closed p-l- closed 2 months ago

p-l- commented 2 months ago

As explained by @lrstewart in #146, the technical details mention that:

If there are no signature algorithms in the hello packet, then the string ends without an underscore and is hashed.

The current Zeek reference implementation is hence incorrect and can be fixed by this patch.