JA4: nginx vs. tshark

Live — only connections since the 2026-09-08 14:03:08 UTC upgrade to nginx 1.30.2-24. The previous era (1.30.2-21-epx30-1) is frozen at /ja4-ngx-vs-tshark-archive-sep8-2026; every era is listed on /ja34.

generated 2026-09-29 05:05:03 UTC — 1 row(s) where nginx computed a different JA4 / extension set than tshark — 4726 matched requests out of 5324 eligible HTTPS requests (a persistent connection contributes one request per row-count tick), joined on (proto, client_ip, client_port), nearest capture within ±5 s, ambiguous ties dropped. rows are deduped on (endpoint, fingerprints, UA), not per connection. nginx side: /var/log/nginx/by-ip/*.log; tshark side: /var/log/nginx/tshark-ja4.log (ja4-logger.service). wrong-fingerprint rows are red, absent-at-request-time rows are amber, both sorted first.

JA3 hash differs on 3384/3404 rows — nginx sorts its JA3 extension list, but JA3 is order-sensitive, so the hashes won't match standard JA3 even when the extension set is identical (see ext Δ column).

showing newest 1000 distinct rows; 2404 more not shown.