JA4: nginx vs. tshark — ARCHIVE (epx30-1 era)

Frozen snapshot of the 1.30.2-20-epx30-1 era: connections between the 2026-08-27 12:06:14 UTC cutover and the 2026-08-28 15:27:07 UTC upgrade to nginx 1.30.2-20-epx30-2 (the build carrying the h3 0-RTT fingerprint gate fix, PR #499). Live comparison: /ja4-ngx-vs-tshark. Older pre-epx30-1 era: /ja4-ngx-vs-tshark-archive.

generated 2026-08-28 15:25:02 UTC — 36 row(s) where nginx had no fingerprint at request time (first request of an h3 connection; later requests on the same connection carry the correct value) — 4499 matched requests out of 16287 eligible HTTPS requests (a persistent connection contributes one request per row-count tick), joined on (proto, client_ip, client_port), nearest capture within ±5 s, ambiguous ties dropped. rows are deduped on (endpoint, fingerprints, UA), not per connection. nginx side: /var/log/nginx/by-ip/*.log; tshark side: /var/log/nginx/tshark-ja4.log (ja4-logger.service). wrong-fingerprint rows are red, absent-at-request-time rows are amber, both sorted first.

JA3 hash differs on 3799/3864 rows — nginx sorts its JA3 extension list, but JA3 is order-sensitive, so the hashes won't match standard JA3 even when the extension set is identical (see ext Δ column).

showing newest 1000 distinct rows; 2864 more not shown.