Skip to content

Releases: FoxIO-LLC/ja4

Updating Tag for zkg install

21 Mar 19:43
2597395
Compare
Choose a tag to compare

Updating Release Tag to fix Zeek "zkg install" installing an old version of JA4+

v0.18.1

05 Feb 14:06
16e9298
Compare
Choose a tag to compare

Fixed

  • JA4H: Sort cookie-pairs properly (#58).

v0.18.0

04 Feb 01:53
db49b59
Compare
Choose a tag to compare

Fixed

  • Generate a JA4SSH fingerprint every 200 SSH (layer 7) packets.
  • Fix calculation of JA4H_c (#58).

v0.17.0

01 Feb 13:55
c1e85f8
Compare
Choose a tag to compare

Fixed

  • JA4SSH (mode of TCP payload length): Handle collisions, resolve nondeterminism (#51).
  • JA4L: Fix a panic that only reproduced in dev mode (#51).
  • Fix processing of GRE tunneling traffic (#51).
  • Skip packets with "icmpv6" layer (#51).

Changed

  • ja4: Improve debug logging.
  • ja4x: Provide more context in the error message (#52).

v0.16.2

04 Jan 15:25
fe853f6
Compare
Choose a tag to compare

Fixed

  • JA4: Include SNI (0000) and ALPN (0010) in the "original" outputs (#40).
  • JA4H: Search for "Cookie" and "Referer" fields in a case-insensitive fashion.
  • JA4: Take signature algorithm hex values from signature_algorithms extension only (#41).

v0.16.1

24 Dec 18:12
3ee86cf
Compare
Choose a tag to compare

Fixed

  • JA4SSH: When counting ACK packets, look for bare ACK flags only, skipping SYN-ACK,
    PSH-ACK, FIN-ACK, etc. (#36)

v0.16.0

16 Dec 02:12
Compare
Choose a tag to compare

Changed

  • Handle non-ASCII ALPN strings (#16).

Fixed

  • Support tshark v4.2.0.

v0.15.2

10 Nov 19:52
6d4e5eb
Compare
Choose a tag to compare

Fixed

  • Ignore extraneous TCP flags when choosing packets for JA4L calculation (#22).

v0.15.1

12 Oct 02:30
602d709
Compare
Choose a tag to compare

Fixed

  • Don't skip X.509 certificates contained in "Server Hello" TLS packets.

v0.15.0

10 Oct 18:33
a78e756
Compare
Choose a tag to compare

Added

  • Add capture files and expected output.