search

FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
976 stars 86 forks source link

Handling of headers in JA4H #172

Closed s-spindler closed 1 week ago

s-spindler commented 1 month ago

Hi!

Regarding the number of headers field in JA4H_a; how should an implementation handle values <10 and >99?

Based on the spec for the number of ciphers in JA4 I assume the value is 0-padded for a count <10 and truncated to last 2 digits for count >99. Is that correct?

s-spindler commented 1 month ago

Addendum: if my assumption above is correct, the Python implementation does not limit to max 99. I prepared #173 with a suggested fix.

john-althouse commented 1 month ago

You are correct!

s-spindler commented 1 week ago

Since #173 is merged this can be closed. Feel free to reopen in case you think there's something missing!