Skip to content

fix(ja4t): align Rust JA4T output with Wireshark/Zeek#310

Open
elpy1 wants to merge 1 commit into
FoxIO-LLC:mainfrom
elpy1:ja4t-align-with-wireshark-zeek
Open

fix(ja4t): align Rust JA4T output with Wireshark/Zeek#310
elpy1 wants to merge 1 commit into
FoxIO-LLC:mainfrom
elpy1:ja4t-align-with-wireshark-zeek

Conversation

@elpy1

@elpy1 elpy1 commented Jul 8, 2026

Copy link
Copy Markdown

This PR aligns Rust with Wireshark/Zeek on:

  • Empty TCP options: emit "00" placeholder instead of an empty field
  • Absent MSS / window scale: zero-pad defaults to "00" instead of "0"
    (window scale stays unpadded when nonzero, matching Wireshark)
  • Duplicated MSS / window-scale options: last occurrence wins
    instead of first

Still unresolved:

  • ECN-flagged SYN behavior (accepted by the Rust implementation
    but ignored by Wireshark/Zeek).

Partially addresses #304

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant