JA3 / JA4 endpoints

The fingerprinting surfaces on this box, in one place. /ja3 and /ja4 are aliases for this index.

JA3/JA4 :: nginx <-> tshark
================================================================================
request : 216.73.216.183:3976  HTTP/1.1  TCP
capture : ClientHello captured at 29/09/2026 04:14:39 UTC. 3 requests on this connection

+-- JA4 [MATCH] ----------------------------------------------------------------
| nginx  : t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
| tshark : t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
+--------------------------------------------------------------------------------

That is the request that just loaded this page, correlated with the tshark capture on the wire. JA3 hash, JA3 string and the field decoder: /ja4-ngx-vs-tshark-realtime.

Your current request

/ja34-current nginx-computed JA3, JA4, TLS, HTTP/3, session and connection variables for the request that opens it.
/ja4-ngx-vs-tshark-realtime live — nginx and tshark JA3/JA4 for the exact request that opens it, correlated by transport, client IP and source port.
/ja4-header-reflection checks whether nginx's JA4 variable is computed independently or can be fooled by a client-supplied SSL-JA4 header.

Comparisons and history

/ja4-ngx-vs-tshark live — rolling nginx-versus-tshark JA3/JA4 comparison for nginx 1.30.2-24, since the 2026-09-08 14:03 UTC cutover, rebuilt every minute.
/ja4-ngx-vs-tshark-archive frozen — everything before the 2026-08-27 12:06 UTC cutover: the old binary whose JA4 disagreed with tshark.
/ja4-ngx-vs-tshark-archive_aug_28_2026 frozen — nginx 1.30.2-20-epx30-1, 2026-08-27 12:06 to 2026-08-28 15:27 UTC.
/ja4-ngx-vs-tshark-archive-sep1-2026 frozen — nginx 1.30.2-20-epx30-2, 2026-08-28 15:27 to 2026-09-01 11:33 UTC.
/ja4-ngx-vs-tshark-archive-sep8-2026 frozen — nginx 1.30.2-21-epx30-1, 2026-09-01 11:33 to 2026-09-08 14:03 UTC.
/ja4-coreproxy-vs-tshark.html frozen — EPX-157 core-proxy raw-ClientHello JA4 versus tshark.

Related traffic views

/statistics site traffic grouped and sortable by the JA4 recorded by nginx.
/logs your own raw access-log lines, including the nginx JA3 string and JA4 fingerprint fields.