JA3 / JA3S
Definition
An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software (e.g. a Cobalt Strike beacon or a specific Android version of WhatsApp) without decrypting the session.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- PCAPng
- PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
Explained in
- Live Packet Capture, Traffic Analysis and Deep Packet InspectionAn MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software (e.g. a Cobalt Strike bea...