Skip to content

fix(ja4t): align Rust JA4T output with Wireshark/Zeek - #310

Open
elpy1 wants to merge 1 commit into
FoxIO-LLC:mainfrom
elpy1:ja4t-align-with-wireshark-zeek
Open

fix(ja4t): align Rust JA4T output with Wireshark/Zeek#310
elpy1 wants to merge 1 commit into
FoxIO-LLC:mainfrom
elpy1:ja4t-align-with-wireshark-zeek

Conversation

@elpy1

@elpy1 elpy1 commented Jul 8, 2026

Copy link
Copy Markdown

This PR aligns Rust with Wireshark/Zeek on:

  • Empty TCP options: emit "00" placeholder instead of an empty field
  • Absent MSS / window scale: zero-pad defaults to "00" instead of "0"
    (window scale stays unpadded when nonzero, matching Wireshark)
  • Duplicated MSS / window-scale options: last occurrence wins
    instead of first

Still unresolved:

  • ECN-flagged SYN behavior (accepted by the Rust implementation
    but ignored by Wireshark/Zeek).

Partially addresses #304

@vlvkobal vlvkobal linked an issue Jul 28, 2026 that may be closed by this pull request
@vlvkobal

vlvkobal commented Aug 6, 2026

Copy link
Copy Markdown
Member

JA4T numeric fields are formatted as decimal values, while 00 is reserved for fields that are absent. The current implementation conflates a missing value with a present value of zero. Could you update the formatting logic and tests to preserve this distinction?

@john-althouse, since this behavior is not currently documented publicly, should we add it somewhere?

@vlvkobal
vlvkobal self-requested a review August 6, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

JA4T: no text specification, and Rust diverges from Wireshark/Zeek

2 participants