Intermediate20 min

JA4T - TCP Client Fingerprinting

JA4T fingerprints TCP clients by analyzing the SYN packet's window size, TCP options, and Maximum Segment Size (MSS). These values are set by the operating system's TCP/IP stack, making JA4T an effective OS fingerprinting tool.

Prerequisites

  • Understanding of TCP three-way handshake
  • JA4 lab completed

What is JA4T?

JA4T creates a fingerprint from the first TCP SYN packet of a connection. The TCP window size, options (MSS, window scale, SACK, timestamps), and their ordering are determined by the client's operating system kernel, not the application. This makes JA4T difficult to spoof without kernel-level changes.

Passive OS Fingerprinting
Unlike active tools like Nmap that send probe packets, JA4T passively observes normal TCP traffic to identify operating systems. No additional packets are sent, making it invisible to the target.

JA4T Format

65535_2-1-3-1-1-8_1460_8

65535

Window Size

TCP window size from SYN packet

2-1-3-1-1-8

TCP Options

TCP option kinds in order

1460

MSS

Maximum Segment Size value

8

Window Scale

Window scaling factor

TCP Options Decoded

  • 2 - MSS (Maximum Segment Size)
  • 1 - NOP (No-Operation padding)
  • 3 - Window Scale
  • 4 - SACK Permitted
  • 8 - Timestamps

Common OS Fingerprints

65535_2-1-3-1-1-8_1460_8
Windows 10/11Default TCP stack
65535_2-4-8-1-3_1460_7
Linux (recent kernel)SACK + Timestamps
65535_2-1-3-1-1-8_1460_6
macOSSimilar to Windows
14600_2-4-8-1-3_1460_7
Linux (older kernel)Smaller window

Using JA4T

Extract JA4T from pcap
# Extract JA4T fingerprints
tshark -r capture.pcap -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" \
  -T fields -e ip.src -e ja4t.hash

# Count OS fingerprints on your network
tshark -r capture.pcap -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" \
  -T fields -e ja4t.hash | sort | uniq -c | sort -rn

# Compare claimed User-Agent OS vs actual TCP OS
tshark -r capture.pcap \
  -T fields -e ip.src -e ja4t.hash -e http.user_agent
OS Mismatch Detection
If a client claims to be Chrome on Windows (via User-Agent) but its JA4T fingerprint matches Linux, it may be spoofing its identity - a common indicator of automated tools or malware.

Hands-On Exercise

Step 1: Capture SYN Packets

tshark -i eth0 -f "tcp[tcpflags] & tcp-syn != 0" -w syn_capture.pcap -c 100

Step 2: Extract and Group

tshark -r syn_capture.pcap \
  -Y "tcp.flags.syn == 1 && tcp.flags.ack == 0" \
  -T fields -e ip.src -e tcp.window_size_value -e tcp.options -e ja4t.hash

Step 3: Identify Operating Systems

Compare your extracted JA4T fingerprints against the known OS fingerprint table above. Look for any unexpected OS types on your network.

Lab Complete
You can now fingerprint TCP clients for OS identification. Next, learn JA4TS for server-side TCP fingerprinting.