Skip to content

Doc updates to include additional ALPN extension values#277

Merged
vlvkobal merged 5 commits into
FoxIO-LLC:mainfrom
giddij01:ja4-alpn-doc-update
Jan 26, 2026
Merged

Doc updates to include additional ALPN extension values#277
vlvkobal merged 5 commits into
FoxIO-LLC:mainfrom
giddij01:ja4-alpn-doc-update

Conversation

@giddij01
Copy link
Copy Markdown
Contributor

@giddij01 giddij01 commented Jan 21, 2026

Overview

Adding examples to cover space character (sp, 0x20) handling in the ALPN Extension Value as we have seen some unexpected JA4 fingerprints in Wireshark when a space character is sent by the client.

ℹ️ Please note, I have also raised an issue over on the Wireshark repo to highlight what we have seen: https://gitlab.com/wireshark/wireshark/-/issues/20966

Example 1

ALPN Extension Value sent by client:

ALPN Next Protocol: ' ' 
Hex values: 0x20

Resulting JA4 Fingerprint (Note: double space in place of ALPN value)

t13d0808  _b83013aef563_36a8af52ae46

Expected JA4 Fingerprint

t13d080820_b83013aef563_36a8af52ae46

Example 2

ALPN Extension Value sent by client:

ALPN Next Protocol: 'a ' 
Hex values: 0x61 0x20

Resulting JA4 Fingerprint (Note: sinlge space set for second ALPN value)

t13d0808a _b83013aef563_36a8af52ae46

Expected JA4 Fingerprint

t13d080860_b83013aef563_36a8af52ae46

@giddij01 giddij01 marked this pull request as ready for review January 21, 2026 12:35
@johnthacker
Copy link
Copy Markdown

While you do clarify with the exact hex values, it might be worth putting the word "ASCII" in there somewhere when saying alphanumeric (since RFC 7301 clearly anticipates UTF-8 strings (which are not used.)

@giddij01
Copy link
Copy Markdown
Contributor Author

Thanks @johnthacker, I had a go at tweaking based on your feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants