Skip to content

Conversation

@vlvkobal
Copy link
Member

@vlvkobal vlvkobal commented Nov 6, 2025

Following the new JA4D spec, this PR updates the DHCP fingerprint to include:

  • message type character codes (e.g. reqst, offer, …),
  • Requested IP (Opt 50) and FQDN (Opt 81) indicators for DHCPv4; IA_NA (Opt 3) and FQDN (Opt 39) indicators for DHCPv6,
  • corrected item-length formatting and zero-padding.

New JA4D format example:

reqst1500in_61-57-60-12-55_1-3-6-15-26-28-51-58-59-43-114-108

@vlvkobal vlvkobal merged commit 2d81015 into FoxIO-LLC:main Nov 6, 2025
1 check passed
@vlvkobal vlvkobal deleted the update-ja4d branch November 6, 2025 16:23
],
"ja4.ja4d": [
"4-1-00_61-50-55_1-3-6-42"
"disco0000in_61-50-55_1-3-6-42"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm working on the Zeek version and the current spec wants 50 and 81 excluded from listed options as they are covered by the two characters in the first part.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @J0eJ0h - that slipped past me. Will fix it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants