ja4plus 0.2.0__tar.gz

ja4plus-0.2.0/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2024, ja4plus contributors
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ja4plus-0.2.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include LICENSE
+include README.md
+include requirements.txt

ja4plus-0.2.0/PKG-INFO

@@ -0,0 +1,178 @@
+Metadata-Version: 2.4
+Name: ja4plus
+Version: 0.2.0
+Summary: JA4+ network fingerprinting library for TLS, TCP, HTTP, SSH, and X.509 analysis
+Home-page: https://github.com/Crank-Git/ja4plus
+License-Expression: BSD-3-Clause
+Project-URL: Homepage, https://github.com/Crank-Git/ja4plus
+Project-URL: Bug Tracker, https://github.com/Crank-Git/ja4plus/issues
+Project-URL: Source Code, https://github.com/Crank-Git/ja4plus
+Project-URL: Documentation, https://github.com/Crank-Git/ja4plus/tree/main/docs
+Project-URL: JA4+ Specification, https://github.com/FoxIO-LLC/ja4
+Keywords: ja4,ja4plus,fingerprinting,tls,tcp,http,ssh,x509,network,security,scapy
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Networking :: Monitoring
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: scapy>=2.4.0
+Requires-Dist: cryptography>=3.4.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=3.0; extra == "dev"
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-python
+
+# JA4+
+
+A Python library for JA4+ network fingerprinting. Implements all eight JA4+ methods for identifying and classifying network traffic based on TLS, TCP, HTTP, SSH, and X.509 characteristics.
+
+JA4+ is a set of network fingerprinting standards created by [FoxIO](https://foxio.io). This library is an independent Python implementation of the published specification. For the original spec, see the [FoxIO JA4+ repository](https://github.com/FoxIO-LLC/ja4).
+
+## Supported Fingerprint Types
+
+| Type | Protocol | Description |
+|------|----------|-------------|
+| JA4 | TLS | Client fingerprint from ClientHello messages |
+| JA4S | TLS | Server fingerprint from ServerHello messages |
+| JA4H | HTTP | Client fingerprint from request headers and cookies |
+| JA4T | TCP | Client OS fingerprint from SYN packets |
+| JA4TS | TCP | Server fingerprint from SYN-ACK packets |
+| JA4L | TCP | Light distance and latency estimation |
+| JA4X | X.509 | Certificate structure fingerprint from OID sequences |
+| JA4SSH | SSH | Session type classification from traffic patterns |
+
+## Installation
+
+```bash
+pip install ja4plus
+```
+
+Or install from source:
+
+```bash
+git clone https://github.com/Crank-Git/ja4plus.git
+cd ja4plus
+pip install -e .
+```
+
+## Quick Start
+
+```python
+from scapy.all import rdpcap
+from ja4plus import JA4Fingerprinter
+
+packets = rdpcap("capture.pcap")
+
+fp = JA4Fingerprinter()
+for packet in packets:
+    result = fp.process_packet(packet)
+    if result:
+        print(f"JA4: {result}")
+```
+
+## Usage
+
+### Class-Based API
+
+Each fingerprinter processes packets and collects results:
+
+```python
+from ja4plus import JA4Fingerprinter, JA4SFingerprinter, JA4TFingerprinter
+
+ja4 = JA4Fingerprinter()
+ja4s = JA4SFingerprinter()
+ja4t = JA4TFingerprinter()
+
+for packet in packets:
+    ja4.process_packet(packet)
+    ja4s.process_packet(packet)
+    ja4t.process_packet(packet)
+
+for entry in ja4.get_fingerprints():
+    print(entry["fingerprint"])
+```
+
+### Function-Based API
+
+For one-shot fingerprinting of individual packets:
+
+```python
+from ja4plus import generate_ja4, generate_ja4s, generate_ja4h
+
+fingerprint = generate_ja4(packet)
+```
+
+### All Fingerprinters
+
+```python
+from ja4plus import (
+    JA4Fingerprinter,      # TLS Client
+    JA4SFingerprinter,     # TLS Server
+    JA4HFingerprinter,     # HTTP
+    JA4TFingerprinter,     # TCP Client (SYN)
+    JA4TSFingerprinter,    # TCP Server (SYN-ACK)
+    JA4LFingerprinter,     # Latency
+    JA4XFingerprinter,     # X.509 Certificate
+    JA4SSHFingerprinter,   # SSH
+)
+```
+
+All fingerprinters share a common interface:
+
+| Method | Description |
+|--------|-------------|
+| `process_packet(pkt)` | Process a packet, returns fingerprint string or `None` |
+| `get_fingerprints()` | Returns list of all collected fingerprint dicts |
+| `reset()` | Clears all collected state |
+
+See [`docs/usage.md`](docs/usage.md) for detailed usage of each fingerprinter.
+
+## Fingerprint Formats
+
+| Type | Format | Example |
+|------|--------|---------|
+| JA4 | `{proto}{ver}{sni}{ciphcnt}{extcnt}{alpn}_{hash}_{hash}` | `t13d1516h2_8daaf6152771_e5627efa2ab1` |
+| JA4S | `{proto}{ver}{extcnt}{alpn}_{cipher}_{hash}` | `t130200_1301_a56c5b993250` |
+| JA4H | `{method}{ver}{cookie}{ref}{cnt}{lang}_{hash}_{hash}_{hash}` | `ge11cr0800_edb4461d7a83_4817af47a558_...` |
+| JA4T | `{window}_{options}_{mss}_{wscale}` | `65535_2-4-8-1-3_1460_7` |
+| JA4TS | `{window}_{options}_{mss}_{wscale}` | `14600_2-4-8-1-3_1460_0` |
+| JA4L | `{latency_us}_{ttl}` | `2500_56` |
+| JA4X | `{issuer_hash}_{subject_hash}_{ext_hash}` | `a37f49ba31e2_a37f49ba31e2_dd4f1a0ef8b2` |
+| JA4SSH | `c{mode}s{mode}_c{pkts}s{pkts}_c{acks}s{acks}` | `c36s36_c51s80_c69s0` |
+
+## Requirements
+
+- Python 3.8+
+- [scapy](https://scapy.net/) >= 2.4.0
+- [cryptography](https://cryptography.io/) >= 3.4.0
+
+## Development
+
+```bash
+git clone https://github.com/Crank-Git/ja4plus.git
+cd ja4plus
+pip install -e ".[dev]"
+pytest tests/ -v
+```
+
+## License
+
+BSD 3-Clause License. See [LICENSE](LICENSE) for details.
+
+## Acknowledgments
+
+JA4+ was created by John Althouse at [FoxIO](https://foxio.io). This library is an independent implementation of the published specification. For the original spec and reference implementation, see [github.com/FoxIO-LLC/ja4](https://github.com/FoxIO-LLC/ja4).

ja4plus-0.2.0/README.md

@@ -0,0 +1,140 @@
+# JA4+
+
+A Python library for JA4+ network fingerprinting. Implements all eight JA4+ methods for identifying and classifying network traffic based on TLS, TCP, HTTP, SSH, and X.509 characteristics.
+
+JA4+ is a set of network fingerprinting standards created by [FoxIO](https://foxio.io). This library is an independent Python implementation of the published specification. For the original spec, see the [FoxIO JA4+ repository](https://github.com/FoxIO-LLC/ja4).
+
+## Supported Fingerprint Types
+
+| Type | Protocol | Description |
+|------|----------|-------------|
+| JA4 | TLS | Client fingerprint from ClientHello messages |
+| JA4S | TLS | Server fingerprint from ServerHello messages |
+| JA4H | HTTP | Client fingerprint from request headers and cookies |
+| JA4T | TCP | Client OS fingerprint from SYN packets |
+| JA4TS | TCP | Server fingerprint from SYN-ACK packets |
+| JA4L | TCP | Light distance and latency estimation |
+| JA4X | X.509 | Certificate structure fingerprint from OID sequences |
+| JA4SSH | SSH | Session type classification from traffic patterns |
+
+## Installation
+
+```bash
+pip install ja4plus
+```
+
+Or install from source:
+
+```bash
+git clone https://github.com/Crank-Git/ja4plus.git
+cd ja4plus
+pip install -e .
+```
+
+## Quick Start
+
+```python
+from scapy.all import rdpcap
+from ja4plus import JA4Fingerprinter
+
+packets = rdpcap("capture.pcap")
+
+fp = JA4Fingerprinter()
+for packet in packets:
+    result = fp.process_packet(packet)
+    if result:
+        print(f"JA4: {result}")
+```
+
+## Usage
+
+### Class-Based API
+
+Each fingerprinter processes packets and collects results:
+
+```python
+from ja4plus import JA4Fingerprinter, JA4SFingerprinter, JA4TFingerprinter
+
+ja4 = JA4Fingerprinter()
+ja4s = JA4SFingerprinter()
+ja4t = JA4TFingerprinter()
+
+for packet in packets:
+    ja4.process_packet(packet)
+    ja4s.process_packet(packet)
+    ja4t.process_packet(packet)
+
+for entry in ja4.get_fingerprints():
+    print(entry["fingerprint"])
+```
+
+### Function-Based API
+
+For one-shot fingerprinting of individual packets:
+
+```python
+from ja4plus import generate_ja4, generate_ja4s, generate_ja4h
+
+fingerprint = generate_ja4(packet)
+```
+
+### All Fingerprinters
+
+```python
+from ja4plus import (
+    JA4Fingerprinter,      # TLS Client
+    JA4SFingerprinter,     # TLS Server
+    JA4HFingerprinter,     # HTTP
+    JA4TFingerprinter,     # TCP Client (SYN)
+    JA4TSFingerprinter,    # TCP Server (SYN-ACK)
+    JA4LFingerprinter,     # Latency
+    JA4XFingerprinter,     # X.509 Certificate
+    JA4SSHFingerprinter,   # SSH
+)
+```
+
+All fingerprinters share a common interface:
+
+| Method | Description |
+|--------|-------------|
+| `process_packet(pkt)` | Process a packet, returns fingerprint string or `None` |
+| `get_fingerprints()` | Returns list of all collected fingerprint dicts |
+| `reset()` | Clears all collected state |
+
+See [`docs/usage.md`](docs/usage.md) for detailed usage of each fingerprinter.
+
+## Fingerprint Formats
+
+| Type | Format | Example |
+|------|--------|---------|
+| JA4 | `{proto}{ver}{sni}{ciphcnt}{extcnt}{alpn}_{hash}_{hash}` | `t13d1516h2_8daaf6152771_e5627efa2ab1` |
+| JA4S | `{proto}{ver}{extcnt}{alpn}_{cipher}_{hash}` | `t130200_1301_a56c5b993250` |
+| JA4H | `{method}{ver}{cookie}{ref}{cnt}{lang}_{hash}_{hash}_{hash}` | `ge11cr0800_edb4461d7a83_4817af47a558_...` |
+| JA4T | `{window}_{options}_{mss}_{wscale}` | `65535_2-4-8-1-3_1460_7` |
+| JA4TS | `{window}_{options}_{mss}_{wscale}` | `14600_2-4-8-1-3_1460_0` |
+| JA4L | `{latency_us}_{ttl}` | `2500_56` |
+| JA4X | `{issuer_hash}_{subject_hash}_{ext_hash}` | `a37f49ba31e2_a37f49ba31e2_dd4f1a0ef8b2` |
+| JA4SSH | `c{mode}s{mode}_c{pkts}s{pkts}_c{acks}s{acks}` | `c36s36_c51s80_c69s0` |
+
+## Requirements
+
+- Python 3.8+
+- [scapy](https://scapy.net/) >= 2.4.0
+- [cryptography](https://cryptography.io/) >= 3.4.0
+
+## Development
+
+```bash
+git clone https://github.com/Crank-Git/ja4plus.git
+cd ja4plus
+pip install -e ".[dev]"
+pytest tests/ -v
+```
+
+## License
+
+BSD 3-Clause License. See [LICENSE](LICENSE) for details.
+
+## Acknowledgments
+
+JA4+ was created by John Althouse at [FoxIO](https://foxio.io). This library is an independent implementation of the published specification. For the original spec and reference implementation, see [github.com/FoxIO-LLC/ja4](https://github.com/FoxIO-LLC/ja4).

ja4plus-0.2.0/ja4plus/__init__.py

@@ -0,0 +1,30 @@
+"""
+JA4+ - Network Fingerprinting Library
+
+A Python implementation of the JA4+ network fingerprinting methods
+created by FoxIO LLC. Supports TLS, TCP, HTTP, SSH, and X.509
+fingerprinting for network security monitoring and traffic analysis.
+"""
+
+from ja4plus.fingerprinters.ja4 import JA4Fingerprinter
+from ja4plus.fingerprinters.ja4s import JA4SFingerprinter
+from ja4plus.fingerprinters.ja4h import JA4HFingerprinter
+from ja4plus.fingerprinters.ja4l import JA4LFingerprinter
+from ja4plus.fingerprinters.ja4x import JA4XFingerprinter
+from ja4plus.fingerprinters.ja4ssh import JA4SSHFingerprinter
+from ja4plus.fingerprinters.ja4t import JA4TFingerprinter
+from ja4plus.fingerprinters.ja4ts import JA4TSFingerprinter
+
+# Function-based API
+from ja4plus.fingerprinters.ja4 import generate_ja4
+from ja4plus.fingerprinters.ja4s import generate_ja4s
+from ja4plus.fingerprinters.ja4h import generate_ja4h
+from ja4plus.fingerprinters.ja4l import generate_ja4l
+from ja4plus.fingerprinters.ja4x import generate_ja4x
+from ja4plus.fingerprinters.ja4ssh import generate_ja4ssh
+from ja4plus.fingerprinters.ja4t import generate_ja4t
+from ja4plus.fingerprinters.ja4ts import generate_ja4ts
+
+__version__ = "0.2.0"
+__author__ = "ja4plus contributors"
+__license__ = "BSD-3-Clause"

ja4plus-0.2.0/ja4plus/collector.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""
+JA4+ collector for Elastic Agent integration.
+Captures network traffic and outputs JA4+ fingerprints as JSON.
+"""
+
+import argparse
+import json
+import sys
+import time
+import signal
+from scapy.all import sniff
+
+from ja4plus.fingerprinters.ja4 import JA4Fingerprinter
+from ja4plus.fingerprinters.ja4s import JA4SFingerprinter
+from ja4plus.fingerprinters.ja4h import JA4HFingerprinter
+from ja4plus.fingerprinters.ja4t import JA4TFingerprinter
+from ja4plus.fingerprinters.ja4ts import JA4TSFingerprinter
+from ja4plus.fingerprinters.ja4x import JA4XFingerprinter
+from ja4plus.fingerprinters.ja4ssh import JA4SSHFingerprinter
+
+# Global variables for signal handling
+packet_count = 0
+max_packets = 0
+start_time = 0
+timeout_seconds = 0
+
+def signal_handler(signum, frame):
+    """Handle termination signals gracefully"""
+    sys.stderr.write("Received signal, shutting down gracefully...\n")
+    sys.exit(0)
+
+def main():
+    """Main collector function"""
+    global packet_count, max_packets, start_time, timeout_seconds
+
+    parser = argparse.ArgumentParser(description="JA4+ Network Fingerprinting Collector")
+    parser.add_argument("--interface", "-i", default="any", help="Network interface to capture on")
+    parser.add_argument("--filter", "-f", default="tcp or udp", help="BPF filter expression")
+    parser.add_argument("--fingerprinters", default="ja4,ja4s,ja4h,ja4t,ja4ts,ja4x,ja4ssh",
+                       help="Comma-separated list of fingerprinters to enable")
+    parser.add_argument("--max-packets", type=int, default=0,
+                       help="Maximum packets to process (0 = unlimited)")
+    parser.add_argument("--timeout", type=float, default=0,
+                       help="Timeout in seconds (0 = no timeout)")
+    parser.add_argument("--output", choices=["json", "text"], default="json",
+                       help="Output format")
+
+    args = parser.parse_args()
+
+    # Set up signal handlers
+    signal.signal(signal.SIGINT, signal_handler)
+    signal.signal(signal.SIGTERM, signal_handler)
+
+    # Initialize global variables
+    max_packets = args.max_packets
+    timeout_seconds = args.timeout
+    start_time = time.time()
+
+    # Initialize enabled fingerprinters
+    available_fingerprinters = {
+        "ja4": JA4Fingerprinter(),
+        "ja4s": JA4SFingerprinter(),
+        "ja4h": JA4HFingerprinter(),
+        "ja4t": JA4TFingerprinter(),
+        "ja4ts": JA4TSFingerprinter(),
+        "ja4x": JA4XFingerprinter(),
+        "ja4ssh": JA4SSHFingerprinter()
+    }
+
+    enabled_fps = args.fingerprinters.split(",")
+    fingerprinters = {}
+    for name in enabled_fps:
+        name = name.strip()
+        if name in available_fingerprinters:
+            fingerprinters[name] = available_fingerprinters[name]
+        else:
+            sys.stderr.write(f"Warning: Unknown fingerprinter '{name}'\n")
+
+    if not fingerprinters:
+        sys.stderr.write("Error: No valid fingerprinters enabled\n")
+        sys.exit(1)
+
+    def process_packet(packet):
+        """Process packet with enabled fingerprinters and output results"""
+        global packet_count
+
+        # Check packet limit
+        if max_packets > 0 and packet_count >= max_packets:
+            return
+
+        # Check timeout
+        if timeout_seconds > 0 and (time.time() - start_time) >= timeout_seconds:
+            return
+
+        packet_count += 1
+
+        results = {
+            "@timestamp": int(time.time() * 1000),  # Elasticsearch expects milliseconds
+            "ja4plus": {}
+        }
+
+        # Apply each enabled fingerprinter
+        for name, fp in fingerprinters.items():
+            try:
+                fingerprint = fp.process_packet(packet)
+                if fingerprint:
+                    results["ja4plus"][name] = fingerprint
+            except Exception as e:
+                sys.stderr.write(f"Error in {name} fingerprinter: {e}\n")
+
+        # Only output if we have fingerprints
+        if results["ja4plus"]:
+            # Add network metadata - properly extract IP addresses
+            try:
+                from scapy.all import IP, IPv6
+
+                # Look for IP layer (IPv4 or IPv6)
+                if packet.haslayer(IP):
+                    ip_layer = packet[IP]
+                    results["source"] = {"ip": ip_layer.src}
+                    results["destination"] = {"ip": ip_layer.dst}
+                elif packet.haslayer(IPv6):
+                    ip_layer = packet[IPv6]
+                    results["source"] = {"ip": ip_layer.src}
+                    results["destination"] = {"ip": ip_layer.dst}
+                elif hasattr(packet, "src") and hasattr(packet, "dst"):
+                    # Fallback to packet-level src/dst (might be MAC addresses)
+                    # Only use if they look like IP addresses
+                    src_str = str(packet.src)
+                    dst_str = str(packet.dst)
+                    if ":" not in src_str or len(src_str.split(":")) <= 4:  # Not a MAC address
+                        results["source"] = {"ip": src_str}
+                        results["destination"] = {"ip": dst_str}
+
+                # Add port information if available
+                from scapy.all import TCP, UDP
+                if packet.haslayer(TCP):
+                    tcp_layer = packet[TCP]
+                    if "source" in results:
+                        results["source"]["port"] = tcp_layer.sport
+                    if "destination" in results:
+                        results["destination"]["port"] = tcp_layer.dport
+                elif packet.haslayer(UDP):
+                    udp_layer = packet[UDP]
+                    if "source" in results:
+                        results["source"]["port"] = udp_layer.sport
+                    if "destination" in results:
+                        results["destination"]["port"] = udp_layer.dport
+
+            except Exception as e:
+                sys.stderr.write(f"Error extracting network metadata: {e}\n")
+
+            # Add collection metadata
+            results["ja4plus"]["interface"] = args.interface
+            results["ja4plus"]["filter"] = args.filter
+            results["ja4plus"]["collection_timestamp"] = int(time.time() * 1000)
+
+            # Output based on format
+            if args.output == "json":
+                print(json.dumps(results))
+            else:
+                print(f"Packet {packet_count}: {results}")
+
+            sys.stdout.flush()
+
+        # Stop if we've reached the packet limit
+        if max_packets > 0 and packet_count >= max_packets:
+            sys.stderr.write(f"Reached packet limit of {max_packets}, stopping...\n")
+            sys.exit(0)
+
+        # Stop if we've reached the timeout
+        if timeout_seconds > 0 and (time.time() - start_time) >= timeout_seconds:
+            sys.stderr.write(f"Reached timeout of {timeout_seconds} seconds, stopping...\n")
+            sys.exit(0)
+
+    try:
+        sys.stderr.write(f"Starting JA4+ collection on interface '{args.interface}' with filter '{args.filter}'\n")
+        sys.stderr.write(f"Enabled fingerprinters: {', '.join(fingerprinters.keys())}\n")
+
+        # Start sniffing
+        sniff(prn=process_packet,
+              filter=args.filter,
+              iface=args.interface if args.interface != "any" else None,
+              store=0)
+
+    except KeyboardInterrupt:
+        sys.stderr.write("Interrupted by user\n")
+    except Exception as e:
+        sys.stderr.write(f"Error during packet capture: {e}\n")
+        sys.exit(1)
+
+if __name__ == "__main__":
+    main()

ja4plus-0.2.0/ja4plus/fingerprinters/__init__.py

@@ -0,0 +1,23 @@
+"""
+JA4+ fingerprinters for various protocols and traffic types.
+"""
+
+from .ja4 import JA4Fingerprinter
+from .ja4s import JA4SFingerprinter
+from .ja4h import JA4HFingerprinter
+from .ja4l import JA4LFingerprinter
+from .ja4x import JA4XFingerprinter
+from .ja4ssh import JA4SSHFingerprinter
+from .ja4t import JA4TFingerprinter
+from .ja4ts import JA4TSFingerprinter
+
+__all__ = [
+    'JA4Fingerprinter',
+    'JA4SFingerprinter',
+    'JA4HFingerprinter',
+    'JA4LFingerprinter',
+    'JA4XFingerprinter',
+    'JA4SSHFingerprinter',
+    'JA4TFingerprinter',
+    'JA4TSFingerprinter'
+] 

ja4plus-0.2.0/ja4plus/fingerprinters/base.py

@@ -0,0 +1,44 @@
+"""
+Base fingerprinter class for JA4+ fingerprinters.
+"""
+
+class BaseFingerprinter:
+    """Base class for all JA4+ fingerprinters."""
+    
+    def __init__(self):
+        """Initialize the fingerprinter."""
+        self.fingerprints = []
+    
+    def process_packet(self, packet):
+        """
+        Process a packet and extract fingerprint if applicable.
+        This method should be overridden by subclasses.
+        
+        Args:
+            packet: A network packet to analyze
+            
+        Returns:
+            The extracted fingerprint if successful, None otherwise
+        """
+        raise NotImplementedError("Subclasses must implement this method.")
+    
+    def add_fingerprint(self, fingerprint, packet):
+        """
+        Add a fingerprint to the collection.
+        
+        Args:
+            fingerprint: The extracted fingerprint
+            packet: The packet that generated this fingerprint
+        """
+        self.fingerprints.append({
+            'fingerprint': fingerprint,
+            'packet': packet
+        })
+    
+    def get_fingerprints(self):
+        """Return all collected fingerprints."""
+        return self.fingerprints
+    
+    def reset(self):
+        """Reset the fingerprinter state."""
+        self.fingerprints = []