TLS / FIELDNOTESNETWORK NOTES / 001

OBSERVING THE CONNECTION

Every hello
has a shape.

Before application data flows, a TLS client introduces itself. The structure of that introduction leaves a network fingerprint.

Inside the ClientHello

Protocol versions, cipher suites, extensions and supported groups describe the capabilities of a client. Their values and ordering can help compare implementations.

ClientHello
  + supported_versions
  + cipher_suites
  + extensions
  + supported_groups
  + signature_algorithms
Illustrative structure. This is not a reading of your connection.

From signals to a fingerprint

JA3 and JA4 are approaches to representing network fingerprints. Each makes different choices about which features to retain and how to normalize them. A compact label helps compare observations across connections.

A clue, not an identity

Library updates, configuration and intermediaries can change a fingerprint. Different applications can share similar characteristics. A fingerprint needs context; it does not uniquely identify a person or prove which application is in use.

About these notes

A small reference page about TLS and the observable shape of network protocols. This page does not calculate your TLS fingerprint.

No JavaScript, cookies, analytics or external assets are used by this page. The server processes connection details needed to deliver it.