← All writing
2026-05-04·6 min read·
JA4 Fingerprints in Practice
Using JA4 and JA4S to catch encrypted traffic anomalies without breaking TLS.
By Streaming Defense
JA4 lets you cluster TLS clients without decrypting the session. Each Signal Fabric frame carries a JA4 and JA4S already computed at the probe.
A simple matcher
tsif (frame.ja4 === "t13d1516h2_8daaf6152771_b1ff8ab2d16f") { alert("known C2 client fingerprint", frame); }
Pair JA4 with ASN and nDPI category to drop false positives quickly.