JA4+: a suite of 15 network fingerprinting methods from TLS to DHCP

A suite of 15 fingerprinting methods covering protocols from TLS and TCP to DHCP and NTP

JA4+ is a collection of network fingerprinting methods developed by FoxIO, covering protocol layers from TLS and TCP through HTTP, SSH, DHCP, and NTP. Short named strings produced by each method identify the behavior of a network connection from either the client or the server side. The output is designed to be both human and machine readable, a choice the README frames as making analysis easier to share across teams and tools.

The README names eight specific use cases and closes with the observation that many more exist. Session hijacking prevention and reverse shell detection are the two where fingerprints act as a real-time gate rather than a record for later review. Malware detection, compliance automation, and location tracking round out the rest; the README groups them without assigning a priority order.

Four FoxIO blog posts accompany the standard. One describes how TLS, HTTP, latency, certificate, and SSH fingerprinting methods each construct their output string. A second covers TCP and active scanning methods, including JA4TScan. A third applies TCP fingerprinting to examine how two named VPN providers produce distinct fingerprints. A fourth describes the two DHCP fingerprinting methods and explains how DHCP traffic can identify a client before any TCP connection forms.

The methods table: 15 short names, each tied to a specific protocol and direction

All 15 current methods are listed in a table pairing each full name with a short name and a one-line description. The table groups methods by both protocol and direction: where a protocol produces a distinct client fingerprint and a distinct server fingerprint, the table assigns a separate entry to each side. Each short name maps to exactly one full name, and the two forms appear interchangeably in vendor documentation and tooling configurations.

HTTP is covered only on the client side (JA4H), while SSH has a server fingerprint entry (JA4SSH) rather than a client one, an asymmetry the table does not explain. TCP splits across JA4T for client behavior and JA4TS for the server response. Active scanning forms a distinct category, with JA4Scan-TLS and JA4Scan-QUIC handling active TLS and QUIC server scanning within this repository.

JA4TScan, the Active TCP Fingerprint Scanner, links to a separate repository at FoxIO-LLC/ja4tscan. The README notes that additional JA4+ methods are in the works, so the 15-method table is not final. The repository topics include JARM as a keyword, but no JARM method appears in the current table, and the README does not explain the discrepancy.

Python, Rust, Wireshark, and Zeek are the four implementations in this repository

Four separate implementations are included, each in a dedicated subdirectory: Python in python/, Rust in rust/, a C-based Wireshark plugin in wireshark/, and Zeek in zeek/. Each carries its own README.md with implementation-specific instructions.

The top-level README's table of contents includes a Binaries section that covers installing tshark and running JA4+ on Linux, macOS, and Windows, but that section is not included in the public description. Run commands and platform requirements for each implementation are in the subdirectory READMEs and in binary packages linked from the repository.

Arkime is the only tool in the vendor table where the row's text includes a qualifier from FoxIO about that tool's relationship to the project. No other vendor row carries a similar qualifier. For analysts who want to explore JA4+ fingerprints in a packet capture environment without first choosing an implementation, Arkime provides that integrated route. The README also refers to a JA4+ Cheat Sheet on X as a quick reference during analysis, though an account is required to access it.

JA4L and JA4LS list Light Distance alongside latency measurement, not as a synonym

Two methods in the table carry descriptions that combine two separate outputs. JA4L is described as "Client to Server Latency Measurement / Light Distance" and JA4LS as "Server to Client Latency Measurement / Light Distance". The forward slash separates Latency Measurement from Light Distance as two distinct things each method produces, not as two names for the same quantity.

Light Distance is not explained in the methods table or in the README text. The FoxIO blog post on JA4T, JA4TS, and JA4TScan is the external reference the README gives for these methods, and that post is where the meaning of Light Distance would be described. Reading the table without noticing the separate Light Distance output risks treating JA4L as a pure latency tool and discarding the second measurement.

This distinction matters for teams building pipelines that store JA4+ outputs. A workflow that retains JA4L records gets both the latency figure and the Light Distance value. One that stores only the latency figure and discards the second column loses that Light Distance output entirely, with no error or warning to signal the omission. JA4L and JA4LS are the only two methods in the 15-method table where this dual-output structure appears.

The vendor table spans cloud providers, SIEM platforms, and network appliances

The README includes a vendor table showing which JA4+ methods each tool or service supports. Among cloud and CDN providers, Cloudflare, AWS Cloudfront, AWS WAF, Google Cloud Armor, and Vercel all appear. Palo Alto Networks, Vectra, Censys, VirusTotal, Team Cymru, GreyNoise, and MISP carry JA4+ support, as do AppOmni, Fortinet, and IntelliGenesis.

Several integrations are marked as under development, including Suricata, nzyme, and 2 tools from Netresec: CapLoader and NetworkMiner. Fastly shows "ask for it" in its support column rather than a confirmed integration status, and SentinelOne appears with an empty support column.

For network appliance and server-side integration, NGINX and F5 BIG-IP modules are listed alongside nfdump, ntop's ntopng, and ntop's nDPI. Two community GoLang implementations exist outside the main repository: driftnet-io/go-ja4x for JA4X and exaring/ja4plus for JA4. The table shows that JA4 (TLS client fingerprinting) has the widest vendor support, while the full JA4+ suite covering all 15 methods has narrower adoption across the entries listed.

JA4TScan is in a separate repository; the methods table is still expanding

JA4TScan at FoxIO-LLC/ja4tscan is listed in the 15-method table but housed in a different repository from the main one. All other methods in the table are covered by the python/, rust/, wireshark/, or zeek/ implementations in this repository. Teams that need active TCP scanning rather than passive fingerprinting will need to clone FoxIO-LLC/ja4tscan separately, since it is not a subdirectory of the main repository.

The README states that additional JA4+ methods are in the works. Organizations that store fingerprints for long-term correlation, or that build detection logic around specific method names, should monitor the methods table for new additions that change the fingerprint schema.

The top-level README's table of contents references a Database section that does not appear in the public description. A ja4plus-mapping.csv file at the repository root maps fingerprint values to known entities, and a pcap/ directory holds sample packet captures for testing. A technical_details/README.md is linked from the top-level README for understanding how to read the fingerprint string format, but its content is not reproduced in the top-level README text. A zkg.meta file supports the Zeek package management workflow.

Custom reuse terms require reading three separate documents at the repository root

Three documents at the repository root carry the custom reuse terms, and GitHub's classifier marks the structure as Other because no SPDX identifier covers that combination. A dedicated FAQ alongside the two main text files signals that commercial integration questions come up often enough to need answers beyond a single text document.

For testing, the repository ships sample packet capture files in the pcap/ directory, and a ja4plus-mapping.csv at the root maps fingerprint values to known entities, giving analysts a reference table to check fingerprints against before writing detection rules. Zeek packaging uses zkg.meta. Rust is listed as the primary language of the repository.

The repository was last pushed on 2026-10-06 and is not archived. Four implementations span Python, Rust, C via the Wireshark plugin, and Zeek, with the 15-method table covering TLS, TCP, HTTP, SSH, DHCP, and NTP fingerprinting methods.

Editorial conclusion

JA4+ is the right fit for network defenders who need consistent fingerprints across TLS, TCP, HTTP, SSH, and DHCP in one framework, and who can work within its custom terms structure. Operators who need to run JA4+ immediately should start in the subdirectory README for their chosen implementation (python/, rust/, wireshark/, or zeek/), because the top-level README's run instructions sit in a section not shown in the public description. Before commercial deployment, read the three reuse documents at the repository root, as the custom structure does not map to a standard identifier and GitHub's classifier marks it as Other.

Frequently asked questions

Official sources

1. FoxIO-LLC/ja4 on GitHub
2. Issues
3. Project website
4. README
5. Releases