JA4+
A suite of network fingerprinting standards for TLS, TCP, HTTP, SSH, and other protocols to facilitate threat detection and security analysis.
What is JA4+?
JA4+ is a suite of open-source network fingerprinting standards that generate unique identifiers for network traffic across protocols like TLS, TCP, HTTP, and SSH. It solves the problem of identifying and tracking devices, applications, and threat actors on a network by creating consistent, readable fingerprints from protocol handshakes and attributes.
Security analysts, threat hunters, network engineers, and developers of security tools who need to detect malicious traffic, identify devices, or analyze network behavior.
Developers choose JA4+ for its modern, extensible design that overcomes limitations of older methods like JA3, its wide adoption across industry tools, and its human-readable format that enables both automated detection and manual analysis.
Overview
JA4+ is a suite of network fingerprinting standards
Use Cases
Best For
- Detecting malware and botnet traffic in network captures
- Identifying operating systems and devices via TCP fingerprints
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
