Question 1

What is JA4+?

Accepted Answer

JA4+ is a suite of network fingerprinting methods created by John Althouse at FoxIO. It builds on the success of JA3 by providing human-readable, machine-sortable fingerprints across multiple network protocols including TLS, HTTP, TCP, SSH, and X.509 certificates. The “+” indicates that JA4 is not a single method but a collection of complementary fingerprinting techniques designed for comprehensive network visibility.

Question 2

How does JA4+ differ from JA3?

Accepted Answer

JA3 produces an MD5 hash of TLS ClientHello parameters, making it opaque and unsortable. JA4+ instead uses a structured a_b_c format where the first section (a) contains human-readable metadata such as protocol version, cipher count, and extension count. This means analysts can immediately understand what a fingerprint represents without needing a lookup database. JA4+ also covers far more protocols than JA3, which only fingerprints TLS client messages.

Question 3

What fingerprinting methods are included in the JA4+ suite?

Accepted Answer

The JA4+ suite includes nine fingerprinting methods: JA4 (TLS Client Fingerprint), JA4S (TLS Server Response / ServerHello), JA4H (HTTP Client Fingerprint), JA4L (Light Distance / Locality based on latency), JA4X (X.509 TLS Certificate Fingerprint), JA4SSH (SSH Traffic Fingerprint based on packet patterns), JA4T (TCP Client Fingerprint from SYN packets), JA4TS (TCP Server Response from SYN-ACK packets), and JA4TScan (Active TCP Fingerprint Scanner for OS identification).

Question 4

Who created JA4+?

Accepted Answer

JA4+ was created by John Althouse at FoxIO. John Althouse is also the creator of JA3 and JA3S (developed while at Salesforce), which became the most widely adopted TLS fingerprinting standards. He founded FoxIO to advance network fingerprinting research. JA4+ was developed with contributions from the network security community, including researchers at FoxIO and feedback from organizations using JA3 in production.

Question 5

What is JA4 (TLS Client Fingerprint)?

Accepted Answer

JA4 fingerprints TLS ClientHello messages to identify client applications. It captures the TLS version, SNI extension, number of cipher suites, number of extensions, ALPN values, and the sorted cipher suite and extension lists. The output is a human-readable string where the first section tells you at a glance what kind of client sent the message — for example, whether it’s using TLS 1.3, how many ciphers it offers, and whether ALPN is present.

Question 6

What is JA4H (HTTP Client Fingerprint)?

Accepted Answer

JA4H fingerprints HTTP clients by analyzing the ordering and values of HTTP headers. Since different HTTP clients (browsers, libraries, malware) send headers in different orders with different default values, JA4H creates a fingerprint from the HTTP method, header field ordering, cookie field ordering, and Accept-Language values. This is especially useful for identifying bots, scrapers, and malware that communicate over HTTP.

Question 7

What is JA4L (Light Distance / Locality)?

Accepted Answer

JA4L measures the time between TCP handshake packets to estimate the physical distance between a client and server. By calculating latency from the SYN/SYN-ACK timing, JA4L can determine whether a connection is local or remote, which helps detect anomalies such as VPN or proxy usage. If a client claims to be in one location but JA4L shows the latency is consistent with a different geographic region, it can indicate deception.

Question 8

What is JA4SSH and how does it detect threats?

Accepted Answer

JA4SSH analyzes SSH traffic patterns by examining the sequence of packet lengths in SSH sessions. Without decrypting the traffic, JA4SSH can distinguish between interactive SSH sessions, SCP file transfers, SSH tunneling, and reverse shells. This is critical for detecting command-and-control (C2) activity that uses SSH tunnels to evade traditional security controls.

Question 9

What tools and platforms support JA4+?

Accepted Answer

JA4+ is supported by a growing ecosystem of security tools including Wireshark (via plugin), Arkime (native support), Zeek (via package), Suricata, AWS (VPC flow logs and Network Firewall), Google Cloud, Cloudflare, F5, HAProxy, nftables, ntopng, NGINX, GreyNoise, Hunt.io, and many others. The Wireshark JA4+ plugin is one of the most popular ways to get started, and Arkime provides JA4+ as searchable indexed fields for large-scale packet analysis.

Question 10

Is JA4+ open source?

Accepted Answer

Yes, JA4+ is open source. The core specifications, reference implementations, and plugins are available on GitHub under the FoxIO-LLC organization. The code is licensed under the FoxIO License 1.1, which allows free use for internal business purposes, security research, and non-commercial education. Commercial vendors who want to include JA4+ in their products should contact FoxIO for licensing details.

Question 11

What is the FoxIO License 1.1?

Accepted Answer

The FoxIO License 1.1 permits the use of JA4+ for internal business purposes, security research, and education at no cost. It allows organizations to use JA4+ in their own security operations, SOC workflows, and threat hunting without any licensing fees. However, commercial redistribution — such as including JA4+ in a commercial product sold to others — requires a separate commercial license from FoxIO. The JA4+ methods are also patent pending.

Question 12

How is JA4+ used for threat detection?

Accepted Answer

JA4+ enables threat detection by creating unique fingerprints for every network connection. Security teams can build detection rules based on known-malicious fingerprints, detect anomalies when a client’s fingerprint doesn’t match its claimed identity (e.g., malware pretending to be Chrome), track threat actors across infrastructure, identify C2 communications via consistent fingerprint patterns, and correlate network behavior across TLS, HTTP, TCP, and SSH layers simultaneously.

Question 13

How does JA4+ help detect malware and C2 traffic?

Accepted Answer

Malware and C2 frameworks typically use specific TLS libraries and configurations that produce unique JA4 fingerprints. For example, a Cobalt Strike beacon will have a consistent JA4 fingerprint regardless of which domain it connects to. By combining JA4 (TLS client), JA4H (HTTP headers), and JA4SSH (SSH patterns), analysts can identify malware families even when they change domains, IPs, or certificates. JA4X can additionally fingerprint certificates used by C2 servers.

Question 14

What is the JA4+ fingerprint database (JA4DB)?

Accepted Answer

The JA4 fingerprint database, available at ja4db.foxio.io, is a community-maintained database of known JA4+ fingerprints mapped to applications, libraries, and tools. Security analysts can look up a fingerprint to identify what software generated it, or search the database to find fingerprints associated with known malware. The database includes fingerprints for common browsers, TLS libraries, operating systems, and malicious tools.

Question 15

What are the new JA4L and JA4X labs?

Accepted Answer

We recently added hands-on labs for JA4L (Light Distance / Locality) and JA4X (X.509 Certificate Fingerprinting). The JA4L lab teaches you how to estimate physical distance to a client to detect VPNs and proxies. The JA4X lab demonstrates how to track malicious infrastructure by analyzing the structural properties and extensions of X.509 certificates.

Question 16

What are JA4T and JA4TS used for?

Accepted Answer

JA4T fingerprints TCP SYN packets to passively identify client operating systems based on their TCP stack implementation — including window size, TCP options, and MSS values. JA4TS fingerprints the corresponding SYN-ACK responses from servers. Together, they enable passive OS identification without any application-layer traffic, which is useful for asset inventory, network baselining, and detecting rogue devices on a network.

Question 17

What is JA4TScan?

Accepted Answer

JA4TScan is an active TCP fingerprint scanner that sends crafted TCP packets to a target and analyzes the responses to identify the remote operating system and TCP stack configuration. Unlike the passive JA4T/JA4TS methods, JA4TScan actively probes targets, similar in concept to nmap OS detection but using the JA4+ fingerprinting format for consistent, sortable results that integrate with the rest of the JA4+ ecosystem.

Question 18

How do I get started with JA4+ in Wireshark?

Accepted Answer

To use JA4+ in Wireshark, download the JA4+ Wireshark plugin from the FoxIO GitHub repository and install it in your Wireshark plugins directory. Once installed, JA4+ fingerprints appear as new columns and filter fields in Wireshark. You can filter traffic by specific JA4 fingerprints, add JA4+ columns to your packet list, and use display filters like ‘ja4.hash’ to find specific client fingerprints in your packet captures.

Question 19

Can JA4+ fingerprints be spoofed?

Accepted Answer

While it is theoretically possible to modify a client’s TLS, HTTP, or TCP parameters to mimic a different fingerprint, doing so is difficult in practice and often introduces detectable inconsistencies. The strength of JA4+ is that it fingerprints multiple protocol layers simultaneously — spoofing JA4 (TLS) alone won’t change the JA4T (TCP) or JA4H (HTTP) fingerprints. This multi-layer approach makes evasion significantly more challenging than with single-protocol fingerprinting.

Frequently Asked Questions