Conversation
Lower port is now correctly identified as server, not client. Previously the logic was inverted: src_port < dst_port made src the client, but conventionally the lower (listening) port is the server side.
Handles out-of-order segments, duplicates, overlaps, and gap detection. Used by JA4H and JA4X for multi-segment payload reassembly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
JA4L, JA4SSH, and JA4X now use get_ip_layer() to handle both IPv4 and IPv6 packets. JA4T/JA4TS already worked (TCP-only checks). JA4/JA4S/JA4H work via extract_tls_info/extract_http_info which operate on Raw layer regardless of IP version. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HTTP requests spanning multiple TCP segments are now reassembled before parsing. Uses TCPStreamReassembler for sequence-aware reassembly. Single-packet requests continue to work as before. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces naive arrival-order stream concatenation with TCPStreamReassembler for correct handling of out-of-order TCP segments during certificate extraction.
# Conflicts: # ja4plus/utils/packet_utils.py
# Conflicts: # ja4plus/utils/packet_utils.py # ja4plus/utils/tcp_stream.py
UDP packets are now checked for QUIC Initial data before falling through to standard TLS parsing. QUIC ClientHellos produce tls_info dicts with is_quic=True, triggering the 'q' protocol prefix in JA4.
Adds QUIC section to usage guide, new utilities to API reference, and bumps version to 0.4.0. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
qprotocol prefix in JA4 fingerprintspacket_utilshelpersTCPStreamReassemblerused by JA4H (multi-segment HTTP) and JA4X (out-of-order certificate delivery)docs/implementation_notes.mddocumenting all undocumented spec deviations for Go port referenceNew files
ja4plus/utils/quic_utils.pyja4plus/utils/tcp_stream.pyja4plus/utils/packet_utils.pydocs/implementation_notes.mdTest plan
🤖 Generated with Claude Code