ja3-rs

crates.io Build Status Documentation license

A small JA3 TLS fingerprinting library written in Rust.

This crate enables a consumer to fingerprint the ClientHello portion of a TLS handshake. It can hash TLS handshakes over IPv4 and IPv6. It heavily depends on the tls-parser project from Rusticata.

It supports generating fingerprints from packet capture files as well as live-captures on a network interface, both using libpcap.

See the original JA3 project for more information.

Example of fingerprinting a packet capture file:

```rust use ja3::Ja3;

let mut ja3 = Ja3::new("test.pcap") .process_pcap() .unwrap();

// Now we have a Vec of Ja3Hash objects for hash in ja3 { println!("{}", hash); } ```

Example of fingerprinting a live capture:

```rust use ja3::Ja3;

let mut ja3 = Ja3::new("eth0") .process_live(|x| { println!("{}", x); }) .unwrap();

```