Detect malware with ja3 fingerprints IPv4 and TLS 1.2 only Uses netfilter userspace queues to hook into iptables for all outgoing tcp connections