Skip to content
A wireshark/tshark plugin for the JA3 TLS Client Fingerprinting Algorithm
Lua
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Initial commit Jul 5, 2019
README.md Improved README.md with information what this Wireshark plugin does. Feb 5, 2020
ja3.lua Improved Wireshark JA3-dissector by adding JA3S hash. Feb 5, 2020

README.md

JA3 - Wireshark/tshark plugin

An implementation of the JA3 TLS client fingerprinting algorithm for wireshark/tshark.

Installation

  1. Copy ja3.lua to the plugin folder
  2. Download a copy of md5.lua and copy it to the plugin folder
    • Alternatively Ubuntu users can install a compatible library by running apt install lua-md5

Usage

In Wireshark, for TLS or SSL packets, this plugin will display addinitional information. JA3 information in form of full info and MD5-hash for client handshake packets. JA3S information will be displayed for server hello packets.

You can’t perform that action at this time.