# \[zeek\] \[script\] JA4 Fingerprinting Support

**URL:** <https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152>\
**Category:** Zeek\
**Tags:** development\
**Created:** [September 27, 2023, 8:25am UTC](https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152 "2023-09-27T08:25:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eladsolomon](https://avatars.discourse-cdn.com/v4/letter/e/f07891/32.png) [@eladsolomon](https://community.zeek.org/u/eladsolomon)\
**Post date:** [September 27, 2023, 8:25am UTC](https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152/1 "2023-09-27T08:25:05Z")

</div>

Hello fellow Zeekers!

Did you know? **JA4** was just released: [JA4+ Network Fingerprinting. TL;DR | by John Althouse | Sep, 2023 | FoxIO](https://blog.foxio.io/ja4-network-fingerprinting-9376fe9ca637)

This is a huge leap from JA3, as it handles randomly created TLS certificates as well as support fingerprinting over many additional protocols - UDP, SSH, etc.

Eagerly expecting to see a Zeek package that supports JA4!  
Is anyone currently working on it?

---

<div class="post-metadata">

**Author:** ![ntyze](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/ntyze/32/696_2.png) [@ntyze](https://community.zeek.org/u/ntyze)\
**Post date:** [November 16, 2023, 3:09pm UTC](https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152/2 "2023-11-16T15:09:13Z")

</div>

Released today: [https://github.com/FoxIO-LLC/ja4/tree/main/zeek](https://github.com/FoxIO-LLC/ja4/tree/main/zeek)

---

<div class="post-metadata">

**Author:** ![JA1](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@JA1](https://community.zeek.org/u/JA1)\
**Post date:** [February 28, 2024, 8:38pm UTC](https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152/3 "2024-02-28T20:38:21Z")

</div>

The repo now includes all of JA4+ methods as zeek scripts

zkg install zeek/foxio/ja4

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [April 8, 2026, 6:50pm UTC](https://community.zeek.org/t/zeek-script-ja4-fingerprinting-support/7152/4 "2026-04-08T18:50:29Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.