ja4 icon indicating copy to clipboard operation
ja4 copied to clipboard

Handling of headers in JA4H

Open s-spindler opened this issue 1 year ago • 2 comments

Hi!

Regarding the number of headers field in JA4H_a; how should an implementation handle values <10 and >99?

Based on the spec for the number of ciphers in JA4 I assume the value is 0-padded for a count <10 and truncated to last 2 digits for count >99. Is that correct?

s-spindler avatar Sep 24 '24 22:09 s-spindler

Addendum: if my assumption above is correct, the Python implementation does not limit to max 99. I prepared #173 with a suggested fix.

s-spindler avatar Sep 24 '24 22:09 s-spindler

You are correct!

john-althouse avatar Sep 27 '24 14:09 john-althouse

Since #173 is merged this can be closed. Feel free to reopen in case you think there's something missing!

s-spindler avatar Nov 04 '24 09:11 s-spindler