.git-blame-ignore-revs
.gitignore
.issue-flow.json
CHANGELOG.md
CLAUDE.md
LICENSE
README.md
mkdocs.yml
pyproject.toml
.claude/settings.json
.claude/rules/agent-reports.md
.claude/rules/batch-gate.md
.claude/rules/conformance.md
.claude/rules/external-apis.md
.claude/rules/ste.md
.claude/skills/conformance/SKILL.md
.claude/skills/release/SKILL.md
.claude/skills/test/SKILL.md
.github/dependabot.yml
.github/workflows/docs-build.yml
.github/workflows/docs.yml
.github/workflows/publish.yml
.github/workflows/test.yml
.github/workflows/update-db.yml
assets/logo.png
docs/README.md
docs/api_reference.md
docs/concurrency.md
docs/implementation_notes.md
docs/migration-0.6-to-1.0.md
docs/mutation_sweep.md
docs/output-schema.md
docs/performance.md
docs/usage.md
docs/methods/index.md
docs/methods/ja4.md
docs/methods/ja4d.md
docs/methods/ja4d6.md
docs/methods/ja4h.md
docs/methods/ja4l.md
docs/methods/ja4ls.md
docs/methods/ja4s.md
docs/methods/ja4ssh.md
docs/methods/ja4t.md
docs/methods/ja4ts.md
docs/methods/ja4x.md
docs/mutation_reports/412-utils.json
docs/mutation_reports/413-fingerprinters.json
docs/mutation_reports/414-interface.json
docs/mutation_settlements/412-utils.json
docs/mutation_settlements/413-fingerprinters.json
docs/mutation_settlements/414-interface.json
docs/reference/fingerprinters.md
docs/reference/index.md
docs/reference/ja4db.md
docs/reference/processor.md
docs/reference/types.md
docs/specs/spec.html
docs/specs/spec.md
docs/specs/features/00-foundation.md
docs/specs/features/01-spec-conformance.md
docs/specs/features/02-correctness-audit.md
docs/specs/features/03-concurrency-safety.md
docs/specs/features/04-typed-api.md
docs/specs/features/05-structured-output.md
docs/specs/features/06-live-capture.md
docs/specs/features/07-db-enrichment.md
docs/specs/features/08-documentation.md
docs/specs/features/09-release.md
docs/specs/features/11-pre-release-validation.md
docs/specs/foxio/JA4.md
docs/specs/foxio/JA4D.md
docs/specs/foxio/JA4H.md
docs/specs/foxio/JA4L.md
docs/specs/foxio/JA4S.md
docs/specs/foxio/JA4SSH.md
docs/specs/foxio/JA4T.md
docs/specs/foxio/JA4X.md
docs/specs/foxio/README.md
docs/specs/foxio/deleted-text-specifications.md
docs/specs/foxio/zeek.md
docs/specs/mockups/01-cli-output.html
examples/demo_fingerprints.py
examples/live_traffic_fingerprinting.py
examples/pcap_analysis.py
examples/tcpdump_workflows.py
examples/threat_detection.py
ja4plus/__init__.py
ja4plus/cli.py
ja4plus/ja4db.py
ja4plus/output.py
ja4plus/processor.py
ja4plus/py.typed
ja4plus/types.py
ja4plus/watch.py
ja4plus.egg-info/PKG-INFO
ja4plus.egg-info/SOURCES.txt
ja4plus.egg-info/dependency_links.txt
ja4plus.egg-info/entry_points.txt
ja4plus.egg-info/requires.txt
ja4plus.egg-info/top_level.txt
ja4plus/data/ja4plus-mapping.csv
ja4plus/fingerprinters/__init__.py
ja4plus/fingerprinters/base.py
ja4plus/fingerprinters/ja4.py
ja4plus/fingerprinters/ja4d.py
ja4plus/fingerprinters/ja4d6.py
ja4plus/fingerprinters/ja4h.py
ja4plus/fingerprinters/ja4l.py
ja4plus/fingerprinters/ja4s.py
ja4plus/fingerprinters/ja4ssh.py
ja4plus/fingerprinters/ja4t.py
ja4plus/fingerprinters/ja4ts.py
ja4plus/fingerprinters/ja4x.py
ja4plus/utils/__init__.py
ja4plus/utils/http_utils.py
ja4plus/utils/icmp_quoted.py
ja4plus/utils/loopback.py
ja4plus/utils/packet_utils.py
ja4plus/utils/quic_utils.py
ja4plus/utils/ssh_utils.py
ja4plus/utils/state_table.py
ja4plus/utils/tcp_options.py
ja4plus/utils/tcp_stream.py
ja4plus/utils/tls_utils.py
ja4plus/utils/tunnels.py
ja4plus/utils/x509_utils.py
tests/__init__.py
tests/batch_gate.py
tests/build_alpn_condition_capture.py
tests/build_ja4ts_rst.py
tests/build_quic_ja4l_captures.py
tests/build_ssh_retransmission.py
tests/citation_line_allowlist.json
tests/compare_zeek_baselines.py
tests/conformance_index.py
tests/conftest.py
tests/dependency_entries.py
tests/documentation_samples.py
tests/download_test_vectors.py
tests/foxio_citation_lines.py
tests/foxio_deviation_owners.json
tests/foxio_deviations.json
tests/foxio_deviations.py
tests/foxio_manifest.py
tests/foxio_vector_manifest.json
tests/generate_foxio_baseline.py
tests/measure_random_client_hello.py
tests/memory_ceiling_run.py
tests/mutation_census.py
tests/mutation_cover.py
tests/mutation_sweep.py
tests/quic_builder.py
tests/release_body.py
tests/release_verification.py
tests/skip_gate.py
tests/state_readers.py
tests/test_agent_report_absence_rule.py
tests/test_alpn_ruling_register.py
tests/test_api_reference_interface_table.py
tests/test_bare_exception_reading.py
tests/test_batch_gate.py
tests/test_batch_gate_protection_rule.py
tests/test_bounded_state_table_adoption.py
tests/test_breaking_change_record.py
tests/test_changelog_round_agreement.py
tests/test_changelog_sentence_exemption.py
tests/test_cleanup_connection.py
tests/test_cli.py
tests/test_cli_closed_window_endpoints.py
tests/test_cli_lookup_opt_in.py
tests/test_cli_output_option.py
tests/test_cli_processor.py
tests/test_cli_types_ja4ls.py
tests/test_compare_zeek_baselines.py
tests/test_comprehensive.py
tests/test_conformance_frame_discrimination.py
tests/test_criterion_counts.py
tests/test_db_cache_directory.py
tests/test_db_item_access.py
tests/test_db_lookup_many.py
tests/test_db_offline.py
tests/test_decryption_non_goal_ruling.py
tests/test_delegated_ruling_rule.py
tests/test_dependency_entries.py
tests/test_dhcp_tunnel_inner_udp.py
tests/test_documentation_behaviour_rule.py
tests/test_documentation_fallback_rule.py
tests/test_documentation_image_count.py
tests/test_documentation_publish.py
tests/test_documentation_samples.py
tests/test_documentation_site.py
tests/test_documentation_version_claims.py
tests/test_documented_method_count.py
tests/test_documented_state_table_count.py
tests/test_download_filter_fields.py
tests/test_edge_cases.py
tests/test_empty_list_sentinel_ruling.py
tests/test_examples.py
tests/test_foxio_citation_lines.py
tests/test_foxio_deviations.py
tests/test_foxio_ja4_transcription.py
tests/test_foxio_license_register.py
tests/test_foxio_manifest.py
tests/test_foxio_rust_parity.py
tests/test_foxio_wireshark_ja4ts.py
tests/test_foxio_zeek_ja4ts.py
tests/test_future_dated_packet_eviction.py
tests/test_generate_foxio_baseline.py
tests/test_get_stream_byte_cap_truncation.py
tests/test_http_header_block_terminator.py
tests/test_installed_wheel.py
tests/test_installed_wheel_selection.py
tests/test_integration.py
tests/test_interpreter_set.py
tests/test_ipv6_support.py
tests/test_ja4.py
tests/test_ja4_alpn.py
tests/test_ja4_alpn_condition.py
tests/test_ja4_deep.py
tests/test_ja4_empty_ext.py
tests/test_ja4_hello_retry.py
tests/test_ja4_original_order.py
tests/test_ja4_raw_branches.py
tests/test_ja4_ssl2_version.py
tests/test_ja4d.py
tests/test_ja4d6_foxio.py
tests/test_ja4d_decisions.py
tests/test_ja4d_foxio.py
tests/test_ja4d_fqdn_name_ruling.py
tests/test_ja4db.py
tests/test_ja4db_empty_list_alias.py
tests/test_ja4h.py
tests/test_ja4h_cookie_list.py
tests/test_ja4h_deep.py
tests/test_ja4h_emission_frame_ruling.py
tests/test_ja4h_large_cookie_header.py
tests/test_ja4h_line_endings.py
tests/test_ja4h_part_a_readings.py
tests/test_ja4h_raw.py
tests/test_ja4h_raw_sorted.py
tests/test_ja4h_reassembly.py
tests/test_ja4h_request_line_and_empty_header_list.py
tests/test_ja4h_retransmission.py
tests/test_ja4h_spec.py
tests/test_ja4l.py
tests/test_ja4l_connection_state.py
tests/test_ja4l_foxio.py
tests/test_ja4l_header_block_terminator.py
tests/test_ja4l_quic_eviction_ruling.py
tests/test_ja4l_quic_marker.py
tests/test_ja4l_quic_point_b_ruling.py
tests/test_ja4l_quic_point_d_emission.py
tests/test_ja4l_quic_repeated_connection.py
tests/test_ja4l_quic_server_hello.py
tests/test_ja4l_return_path.py
tests/test_ja4l_timing_fork_ruling.py
tests/test_ja4l_udp_direction.py
tests/test_ja4s.py
tests/test_ja4s_quic_direction.py
tests/test_ja4s_quic_split_server_hello.py
tests/test_ja4s_raw_order.py
tests/test_ja4ssh.py
tests/test_ja4ssh_close_connection_window.py
tests/test_ja4ssh_deep.py
tests/test_ja4ssh_direction.py
tests/test_ja4ssh_interpret.py
tests/test_ja4ssh_message_count.py
tests/test_ja4ssh_packet_selection_ruling.py
tests/test_ja4ssh_parity_record.py
tests/test_ja4ssh_server_side.py
tests/test_ja4ssh_spec.py
tests/test_ja4ssh_window.py
tests/test_ja4ssh_windows.py
tests/test_ja4t.py
tests/test_ja4t_citation_lines.py
tests/test_ja4t_deep.py
tests/test_ja4t_emission_model_ruling.py
tests/test_ja4t_form.py
tests/test_ja4t_icmp_quoted.py
tests/test_ja4t_syn_selection_ruling.py
tests/test_ja4ts.py
tests/test_ja4ts_delay_rounding_ruling.py
tests/test_ja4ts_part_e.py
tests/test_ja4ts_prefix_bound.py
tests/test_ja4ts_reset.py
tests/test_ja4x.py
tests/test_ja4x_deep.py
tests/test_ja4x_empty_ext.py
tests/test_ja4x_named_exceptions.py
tests/test_ja4x_raw.py
tests/test_ja4x_reassembly.py
tests/test_ja4x_record_scan.py
tests/test_key_log_interface_ruling.py
tests/test_lint_gate_pin.py
tests/test_loopback_link_type.py
tests/test_memory_bounds.py
tests/test_method_pages.py
tests/test_mutation_census.py
tests/test_mutation_cover.py
tests/test_mutation_sweep_annotation_skip.py
tests/test_mutation_sweep_commit.py
tests/test_mutation_sweep_module_list.py
tests/test_mutation_sweep_timeout.py
tests/test_no_retained_packets.py
tests/test_output_schema.py
tests/test_packaging.py
tests/test_packet_utils.py
tests/test_parity.py
tests/test_parser_description.py
tests/test_ported_pattern_cost.py
tests/test_precedence_exception.py
tests/test_processor.py
tests/test_processor_stats.py
tests/test_processor_typed_results.py
tests/test_public_interface.py
tests/test_publish_workflow.py
tests/test_quic_coalesced_datagram_ruling.py
tests/test_quic_crypto_buffer_bound.py
tests/test_quic_integration.py
tests/test_quic_multipacket.py
tests/test_quic_server_initial.py
tests/test_quic_tunnel_inner_udp.py
tests/test_quic_utils.py
tests/test_readme_contracts.py
tests/test_release_body.py
tests/test_release_notes.py
tests/test_release_skill.py
tests/test_requirement_scope.py
tests/test_round_entry_existence.py
tests/test_ruling_vocabulary.py
tests/test_settlement_procedure.py
tests/test_skip_gate.py
tests/test_spec_validation.py
tests/test_specification_changelog.py
tests/test_specification_terms.py
tests/test_state_table.py
tests/test_statistics_thread_term.py
tests/test_tcp_byte_cap_admission_ruling.py
tests/test_tcp_segment_bound_ruling.py
tests/test_tcp_stream.py
tests/test_thread_safety.py
tests/test_throughput.py
tests/test_tls_utils.py
tests/test_tunnels.py
tests/test_types.py
tests/test_us_english_spelling.py
tests/test_utils.py
tests/test_version_gate.py
tests/test_watch.py
tests/test_watch_capture.py
tests/test_watch_drop_count.py
tests/test_watch_statistics.py
tests/test_watch_stop.py
tests/test_wireshark_expected_counts.py
tests/test_workflow_action_pins.py
tests/test_x509_certificate_reader.py
tests/throughput_run.py
tests/universal_skips.json
tests/version_gate.py
tests/data/dns.cap
tests/data/example_cert.der
tests/data/filedownload.dmp
tests/data/http.cap
tests/data/suspectemployeechat.dmp
tests/data/test_cert.der
tests/data/wrongdissector.dmp
tests/foxio_vectors/CVE-2018-6794.pcap
tests/foxio_vectors/CVE-2018-6794.pcap.json
tests/foxio_vectors/NOTICE
tests/foxio_vectors/alpn-condition.pcap
tests/foxio_vectors/alpn-condition.pcap.json
tests/foxio_vectors/badcurveball.pcap
tests/foxio_vectors/badcurveball.pcap.json
tests/foxio_vectors/browsers-x509.pcapng
tests/foxio_vectors/browsers-x509.pcapng.json
tests/foxio_vectors/chrome-cloudflare-quic-with-secrets.pcapng
tests/foxio_vectors/chrome-cloudflare-quic-with-secrets.pcapng.json
tests/foxio_vectors/dhcp.pcapng
tests/foxio_vectors/dhcp.pcapng.json
tests/foxio_vectors/dhcpv6.pcap
tests/foxio_vectors/dhcpv6.pcap.json
tests/foxio_vectors/gre-erspan-vxlan.pcap
tests/foxio_vectors/gre-erspan-vxlan.pcap.json
tests/foxio_vectors/gre-sample.pcap
tests/foxio_vectors/gre-sample.pcap.json
tests/foxio_vectors/http-empty-useragent.pcap
tests/foxio_vectors/http-empty-useragent.pcap.json
tests/foxio_vectors/http1-with-cookies.pcapng
tests/foxio_vectors/http1-with-cookies.pcapng.json
tests/foxio_vectors/http1.pcapng
tests/foxio_vectors/http1.pcapng.json
tests/foxio_vectors/http2-with-cookies.pcapng
tests/foxio_vectors/http2-with-cookies.pcapng.json
tests/foxio_vectors/https-connect.pcap
tests/foxio_vectors/https-connect.pcap.json
tests/foxio_vectors/https3-301-get.pcap
tests/foxio_vectors/https3-301-get.pcap.json
tests/foxio_vectors/ipv6.pcapng
tests/foxio_vectors/ipv6.pcapng.json
tests/foxio_vectors/latest.pcapng
tests/foxio_vectors/latest.pcapng.json
tests/foxio_vectors/macos_tcp_flags.pcap
tests/foxio_vectors/macos_tcp_flags.pcap.json
tests/foxio_vectors/quic-tls-handshake.pcapng
tests/foxio_vectors/quic-tls-handshake.pcapng.json
tests/foxio_vectors/quic-with-several-tls-frames.pcapng
tests/foxio_vectors/quic-with-several-tls-frames.pcapng.json
tests/foxio_vectors/single-packets.pcap
tests/foxio_vectors/single-packets.pcap.json
tests/foxio_vectors/socks-https-example.pcap
tests/foxio_vectors/socks-https-example.pcap.json
tests/foxio_vectors/socks4-https.pcap
tests/foxio_vectors/socks4-https.pcap.json
tests/foxio_vectors/ssh-r.pcap
tests/foxio_vectors/ssh-r.pcap.json
tests/foxio_vectors/ssh-scp-1050.pcap
tests/foxio_vectors/ssh-scp-1050.pcap.json
tests/foxio_vectors/ssh.pcapng
tests/foxio_vectors/ssh.pcapng.json
tests/foxio_vectors/ssh2-malformed.pcap
tests/foxio_vectors/ssh2-malformed.pcap.json
tests/foxio_vectors/ssh2-moloch-crash.pcap
tests/foxio_vectors/ssh2-moloch-crash.pcap.json
tests/foxio_vectors/ssh2.pcapng
tests/foxio_vectors/ssh2.pcapng.json
tests/foxio_vectors/sshv1.pcap
tests/foxio_vectors/sshv1.pcap.json
tests/foxio_vectors/tcpdump-geneve.pcap
tests/foxio_vectors/tcpdump-geneve.pcap.json
tests/foxio_vectors/tls-alpn-h2.pcap
tests/foxio_vectors/tls-alpn-h2.pcap.json
tests/foxio_vectors/tls-handshake.pcapng
tests/foxio_vectors/tls-handshake.pcapng.json
tests/foxio_vectors/tls-non-ascii-alpn.pcapng
tests/foxio_vectors/tls-non-ascii-alpn.pcapng.json
tests/foxio_vectors/tls-sni.pcapng
tests/foxio_vectors/tls-sni.pcapng.json
tests/foxio_vectors/tls12.pcap
tests/foxio_vectors/tls12.pcap.json
tests/foxio_vectors/tls3.pcapng
tests/foxio_vectors/tls3.pcapng.json
tests/foxio_vectors/v6.pcap
tests/foxio_vectors/v6.pcap.json
tests/foxio_vectors/rust_expected/ja4__insta@browsers-x509.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@chrome-cloudflare-quic-with-secrets.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@gre-erspan-vxlan.pcap.snap
tests/foxio_vectors/rust_expected/ja4__insta@https-connect.pcap.snap
tests/foxio_vectors/rust_expected/ja4__insta@latest.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@quic-tls-handshake.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@quic-with-several-tls-frames.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@ssh2.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@tls-handshake.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@tls-sni.pcapng.snap
tests/foxio_vectors/rust_expected/ja4__insta@tls3.pcapng.snap
tests/foxio_vectors/wireshark_expected/CVE-2018-6794.pcap.json
tests/foxio_vectors/wireshark_expected/badcurveball.pcap.json
tests/foxio_vectors/wireshark_expected/browsers-x509.pcapng.json
tests/foxio_vectors/wireshark_expected/chrome-cloudflare-quic-with-secrets.pcapng.json
tests/foxio_vectors/wireshark_expected/dhcp.pcapng.json
tests/foxio_vectors/wireshark_expected/dhcpv6.pcap.json
tests/foxio_vectors/wireshark_expected/gre-erspan-vxlan.pcap.json
tests/foxio_vectors/wireshark_expected/http-empty-useragent.pcap.json
tests/foxio_vectors/wireshark_expected/http1-with-cookies.pcapng.json
tests/foxio_vectors/wireshark_expected/http2-with-cookies.pcapng.json
tests/foxio_vectors/wireshark_expected/https-connect.pcap.json
tests/foxio_vectors/wireshark_expected/https3-301-get.pcap.json
tests/foxio_vectors/wireshark_expected/ipv6.pcapng.json
tests/foxio_vectors/wireshark_expected/latest.pcapng.json
tests/foxio_vectors/wireshark_expected/socks-https-example.pcap.json
tests/foxio_vectors/wireshark_expected/socks4-https.pcap.json
tests/foxio_vectors/wireshark_expected/ssh-r.pcap.json
tests/foxio_vectors/wireshark_expected/ssh-scp-1050.pcap.json
tests/foxio_vectors/wireshark_expected/ssh2-malformed.pcap.json
tests/foxio_vectors/wireshark_expected/ssh2-moloch-crash.pcap.json
tests/foxio_vectors/wireshark_expected/ssh2.pcapng.json
tests/foxio_vectors/wireshark_expected/sshv1.pcap.json
tests/foxio_vectors/wireshark_expected/tcpdump-geneve.pcap.json
tests/foxio_vectors/wireshark_expected/tls-alpn-h2.pcap.json
tests/foxio_vectors/wireshark_expected/tls3.pcapng.json
tests/foxio_vectors/wireshark_expected/v6.pcap.json
tests/foxio_vectors/zeek_expected/Scripts.ja4-conn/conn.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-conn-quic/conn.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-conn-tls3/conn.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-dhcp/ja4d.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-http1-with-cookies/http.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-ssh2/ja4ssh.log
tests/foxio_vectors/zeek_expected/Scripts.ja4-tls-handshake/ssl.log
tests/fuzz/README.md
tests/fuzz/__init__.py
tests/fuzz/conftest.py
tests/fuzz/support.py
tests/fuzz/test_icmp_quoted_header.py
tests/fuzz/test_length_fields.py
tests/fuzz/test_malformed_captures.py
tests/fuzz/test_server_hello_extensions.py
tests/fuzz/test_structural_validity.py
tests/fuzz/test_synthetic_hostile_input.py
tests/fuzz/test_truncated_captures.py