Only getting ja3s info added to the ssl.log, not ja3 info...

salesforce / ja3

JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

BSD 3-Clause "New" or "Revised" License

2.61k stars 289 forks source link

Only getting ja3s info added to the ssl.log, not ja3 info... #54

Closed pussinboots1992 closed 4 years ago

pussinboots1992 commented 4 years ago

I have this weird issue in Zeek where only the ja3s information is being added to my ssl.log file, not sign of any ja3 information...How should I start troubleshooting this ?

I installed using zkg an have the following in my local.zeek file, I had no errors when starting on installing anything (Zeek included):

@load packages

Zeek is installed on my proxy server (running Squid) so it should see all SSL traffic going back and forth.

pussinboots1992 commented 4 years ago

Turns out by re-installing the package via zkg it magicaly solved the problem.