JA4: nginx vs. tshark — ARCHIVE 1.30.2-24 era

Frozen snapshot of the nginx 1.30.2-24 era — connections between the 2026-09-08 14:03:08 UTC cutover and the 2026-11-03 12:24:23 UTC upgrade to 1.30.2-41. Live comparison: /ja4-ngx-vs-tshark; all eras: /ja34.

generated 2026-11-03 12:25:28 UTC — 19 row(s) where nginx computed a different JA4 / extension set than tshark — 3371 matched requests out of 4273 eligible HTTPS requests (a persistent connection contributes one request per row-count tick), joined on (proto, client_ip, client_port), nearest capture within ±5 s, ambiguous ties dropped. rows are deduped on (endpoint, fingerprints, UA), not per connection. nginx side: /var/log/nginx/by-ip/*.log; tshark side: /var/log/nginx/tshark-ja4.log (ja4-logger.service). wrong-fingerprint rows are red, absent-at-request-time rows are amber, both sorted first.

JA3 hash differs on 2489/2538 rows — nginx sorts its JA3 extension list, but JA3 is order-sensitive, so the hashes won't match standard JA3 even when the extension set is identical (see ext Δ column).

showing newest 1000 distinct rows; 1538 more not shown.