v0.18.1

Fixed

• JA4H: Sort cookie-pairs properly (#58).

v0.18.0

Fixed

• Generate a JA4SSH fingerprint every 200 SSH (layer 7) packets.
• Fix calculation of JA4H_c (#58).

v0.17.0

Fixed

• JA4SSH (mode of TCP payload length): Handle collisions, resolve nondeterminism (#51).
• JA4L: Fix a panic that only reproduced in dev mode (#51).
• Fix processing of GRE tunneling traffic (#51).
• Skip packets with "icmpv6" layer (#51).

Changed

• ja4: Improve debug logging.
• ja4x: Provide more context in the error message (#52).

v0.16.2

Fixed

• JA4: Include SNI (0000) and ALPN (0010) in the "original" outputs (#40).
• JA4H: Search for "Cookie" and "Referer" fields in a case-insensitive fashion.
• JA4: Take signature algorithm hex values from signature_algorithms extension only (#41).

v0.16.1

Fixed

• JA4SSH: When counting ACK packets, look for bare ACK flags only, skipping SYN-ACK,
  PSH-ACK, FIN-ACK, etc. (#36)

v0.16.0

Changed

• Handle non-ASCII ALPN strings (#16).

Fixed

• Support tshark v4.2.0.

v0.15.2

Fixed

• Ignore extraneous TCP flags when choosing packets for JA4L calculation (#22).

v0.15.1

Fixed

• Don't skip X.509 certificates contained in "Server Hello" TLS packets.

v0.15.0

Added

• Add capture files and expected output.

v0.14.0

Added

• Add Rust sources of ja4 and ja4x CLI tools.