ja4plus 1.2.2__tar.gz → 1.4.0__tar.gz

{ja4plus-1.2.2 → ja4plus-1.4.0}/.claude/rules/conformance.md

@@ -88,11 +88,12 @@ and under the restored defect. These are the seven moves.
 
 **The conformance value comparison reads the one source that frames nothing.** A per-frame
 comparison is possible only where a source states the frame, and #736 read all four.
+#772 added `sigalg-grease.pcapng`, and the first two counts below include it.
 
 | Source | States a frame | Values |
 |---|---|---|
-| FoxIO Python expected output, `tests/foxio_vectors/*.json` | No | 1203 |
-| FoxIO Rust snapshots, `tests/foxio_vectors/rust_expected/*.snap` | No | 460 |
+| FoxIO Python expected output, `tests/foxio_vectors/*.json` | No | 1211 |
+| FoxIO Rust snapshots, `tests/foxio_vectors/rust_expected/*.snap` | No | 465 |
 | Zeek baselines, `tests/foxio_vectors/zeek_expected/` | No | 7 baselines |
 | FoxIO Wireshark dissector, `tests/foxio_vectors/wireshark_expected/*.json` | Yes, `frame.number` | 724 |
 
@@ -101,7 +102,7 @@ comparison is possible only where a source states the frame, and #736 read all f
 names one of them. **The dissector frames every value it writes**, and #736 measured 724
 framed values and none unframed across 26 files.
 
-**The conformance suite builds all 1203 of its value cases from the first source.** No case
+**The conformance suite builds all 1211 of its value cases from the first source.** No case
 of the suite can read a frame, because the source it reads states none.
 
 ### Why the suite compares no frame

{ja4plus-1.2.2 → ja4plus-1.4.0}/.claude/rules/external-apis.md

@@ -153,10 +153,12 @@ reader checks each one.
 5. The remaining sources hold one value between them.
 
 **Read fact 1 from the vectors, and not from the key form alone.** A value-form key
-states that the Python file holds a value, and on one row that statement is false.
-`gre-erspan-vxlan.pcap/0:65174/JA4T.1` carries the value form, the FoxIO Python file
-holds no JA4T value, and #215 declines the FoxIO Rust value `8192__0_0` rather than a
-Python one. The exception rests on a declined Python value, so it passes over that row.
+states that the Python file holds a value, and that statement can be false. Such a row
+declines the value of another source, and the exception passes over it, because the
+exception rests on a declined Python value. `gre-erspan-vxlan.pcap/0:65174/JA4T.1` was
+that row until #772. The FoxIO Python file holds no JA4T value, and #215 declined the
+FoxIO Rust value `8192__0_0`. The Rust snapshot at FoxIO commit `16b96d95` holds
+`8192_00_00_00`, which `ja4plus` writes, so #772 removed the row.
 
 **A capability decline bars the row.** The exception reaches a row only where the decline
 records a disagreement about the value. It does not reach a row whose decline records a
@@ -179,9 +181,11 @@ prose of its cause.** Read the field.
 values of #129 out of `SOURCE_VALUES`, so the exclusion enforced the bar a second time.
 No case could then read what the field does on the one issue the bar exists for. The
 table now holds all 35, measured against the pinned commit. With `capability` false on
-every #129 entry the reach rises from 6 rows to 25. The same flip on the earlier table
-moved nothing. The 16 JA4H rows of the 35 stay out under the disagreement bar, because
-the Rust value and the Wireshark value differ on each one.
+every #129 entry the reach rises from 6 rows to 41. The same flip on the earlier table
+moved nothing. **#772 read the table again at FoxIO `16b96d95`, and the flip reached 25
+rows before that read.** FoxIO `478359f3` moved the 16 Rust JA4H values, and each one now
+equals the Wireshark value. The disagreement bar therefore holds none of the 35, and the
+field alone bars all of them.
 
 **A disagreement between the remaining sources bars the row.** Where the remaining FoxIO
 sources hold different values, **no source holds the reference and the row stays declined
@@ -211,7 +215,7 @@ decides what the bar covers.
 reference value, and adoption is its own ruling. "Which baselines are usable as
 vectors" in `docs/specs/foxio/zeek.md` holds that ruling for the Zeek package.
 
-**The exception reaches 6 rows of the 138 the register holds.**
+**The exception reaches 6 rows of the 141 the register holds.**
 `tests/test_precedence_exception.py` measures the reach and both counts, and #334 records
 the search. A case reads this sentence, so a register move fails the gate here.
 
@@ -224,9 +228,12 @@ the search. A case reads this sentence, so a register move fails the gate here.
 | `ssh2.pcapng/33:51810/JA4L-S.1` | #225 | Wireshark alone |
 | `tls3.pcapng/25:61884/JA4L-S.1` | #225 | Wireshark alone |
 
-**`FoxIO-LLC/ja4tscan` holds prose and no baseline.** Its `README.md` gives eight
-JA4TScan example values against named operating systems, and two of them record TCP
-option kind 0 inside the JA4T option list. #197 owns the scope ruling.
+**`FoxIO-LLC/ja4tscan` holds source code and no baseline.** Its `README.md` gives eight
+JA4TScan example values against named operating systems, and one of them records TCP
+option kind 0 twice inside the option list. **`module_ja4tscan.c` is the normative
+source**, and the maintainer named it so on 2026-09-30, in #775. Three of the eight
+values do not fit that module. `docs/specs/foxio/JA4TScan.md` holds the transcription and
+the measurement.
 
 **Warning: FoxIO states that `FoxIO-LLC/ja4-nginx-module` is not correct.** Its
 `README.md` opens with a `# NOTICE` section that reads "This version of JA4 has known

{ja4plus-1.2.2 → ja4plus-1.4.0}/CHANGELOG.md

@@ -6,6 +6,56 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+- **JA4 and JA4S write `9` for each ALPN end byte of `0x80` or higher** (#789).
+  Round
+  270. **The maintainer ruled on 2026-10-01 UTC, and the ruling binds both repositories.**
+  Crank-Git/ja4plus-go#801 holds the Go half, and the Go library ships it in `v1.3.0`. The
+  ruling follows `python/ja4.py:156-157` and `rust/ja4/src/tls.rs:635-647` at `16b96d95`.
+  Each end byte of `0x80` or higher now writes `9`, one per end, so `68 ff` writes `h9` and
+  `ff 68` writes `9h`, where both wrote `99`. A one-byte printable value now writes the byte
+  twice, so `2d` writes `--` where it wrote `99`. A control byte below `0x20`, or the byte
+  `0x7F`, at either end still writes `99`, as #162 states. The vector
+  `tls-non-ascii-alpn.pcapng` holds `ba ad`, and it still writes `99`. **The ruling reverses
+  #127, #141 and #162 for those inputs.** `tests/test_alpn_end_byte_ruling.py` builds a
+  ClientHello and a ServerHello for each of 14 inputs. **A replay of the 41 committed
+  captures writes 826 values before the change and 826 after, and 2 differ.** Both sit on
+  `alpn-condition.pcap`, which this project built: stream 2 writes `h9` and stream 3 writes
+  `9h`, which are the FoxIO Rust values. No value of a FoxIO capture moves. The register
+  moves the four entries of stream 2 from #162 to #789 and adds four entries for stream 3, so
+  it holds 141 keys where it held 137. The conformance suite reports 1702 passed, 145 skipped
+  and 137 xfailed before this round, and 1698 passed, 145 skipped and 141 xfailed after it.
+
+- **`ja4plus scan` adds JA4TScan, the FoxIO active TCP server fingerprint** (#775, #776).
+  Round
+  269. **The maintainer reversed the decline of 2026-08-08 on 2026-09-30.** The scanner sends
+  one SYN to each IPv4 target and reads the SYN-ACK and its retransmissions. Parts a to d
+  use the JA4TS form of this project, so a scan value and the passive JA4TS value of one
+  SYN-ACK hold the same four parts. A target whose first answer carries RST writes
+  `0_rst-ack`. **The library changes no firewall state.** The command prints the four
+  `iptables` rules of the FoxIO wrapper, or four pf rules on macOS, and it warns when a
+  SYN-ACK arrives with no retransmission. The scanner lives in `ja4plus/scan/` behind the
+  `scan` extra, and no passive module imports it. `docs/specs/foxio/JA4TScan.md` transcribes
+  `FoxIO-LLC/ja4tscan` at `d01bfec4`, and `docs/specs/features/12-active-scan.md` states 35
+  acceptance criteria. The divergence register records the three places where the FoxIO
+  module writes another form. **The project now implements all twelve FoxIO methods.**
+
+- **JA4 reads a ClientHello that spans TCP segments, and the FoxIO pin moves to `16b96d95`** (#772, #773, #774).
+  Round
+  268. **A post-quantum key share makes a browser ClientHello longer than one TCP segment**,
+  and the JA4 fingerprinter read each segment alone, so it wrote no value for such a hello.
+  `sigalg-grease.pcapng` of FoxIO release v1.0.1 holds a 2034-byte hello in two segments.
+  The fingerprinter now holds the client payload of a connection in a bounded table until
+  the hello is complete, and a gap stops the read at the first byte that has not arrived
+  (#772). **JA4 removes GREASE values from the signature algorithms** at both call sites, as
+  FoxIO `d66336ef` does, and the value of that capture now equals the FoxIO value in all
+  four forms (#773). **A repeated MSS option or window scale option keeps its last value**,
+  which the FoxIO Rust, Wireshark and Zeek sources each do at `16b96d95` (#774). The FoxIO
+  pin moves from `27f0cbf9` to `16b96d95`. The seven Zeek baselines stay at `27f0cbf9`
+  under `ZEEK_COMMIT`, because FoxIO `4e91886c` removed `zeek/tests/Traces`. **A replay of
+  77 captures writes one new value, the JA4 of `sigalg-grease.pcapng` frame 5, and every
+  other value is byte-identical.** The conformance suite reports 1684 passed, 142 skipped
+  and 138 xfailed before this round, and 1702 passed, 145 skipped and 137 xfailed after it.
+
 - **The QUIC CRYPTO reader stops at the first byte that has not arrived** (#762).
   Round
   267. **An outside reporter measured the defect on Windows against a live capture.**
@@ -2087,6 +2137,72 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   **No file under `ja4plus/` changes and no fingerprint moves**, and the conformance suite
   reports 1635 passed, 143 skipped and 140 xfailed.
 
+## [1.4.0] - 2026-10-01
+
+Version 1.4.0 follows version 1.3.0, and no version stands between them. The date of the
+heading above is the date this release reaches `master`. It carries round 270.
+
+**The bump is minor and never patch**, because this release moves published values by a
+ruling that changes a rule, and not by the repair of a defect. It is never major, because it
+adds no name, it removes no name and it renames none.
+
+**The ALPN characters of JA4 and JA4S move on edge inputs** (#789). The maintainer ruled on
+2026-10-01 UTC, and Crank-Git/ja4plus-go#801 ships the same rule in the Go library at
+`v1.3.0`, so the two libraries write one value for each input.
+
+| The first ALPN value | Version 1.3.0 | Version 1.4.0 |
+|---|---|---|
+| `68 ff` | `99` | `h9` |
+| `ff 68` | `99` | `9h` |
+| `2d` | `99` | `--` |
+| `20` | `99` | two spaces |
+| `ba ad` | `99` | `99` |
+| A control byte at either end | `99` | `99` |
+
+**No value of a FoxIO capture moves.** A replay of the 41 committed captures writes 826 values
+at version 1.3.0 and 826 here, and 2 differ. Both sit on `alpn-condition.pcap`, which this
+project built. The conformance suite reports 1702 passed, 145 skipped and 137 xfailed at
+version 1.3.0, and 1698 passed, 145 skipped and 141 xfailed here.
+
+## [1.3.0] - 2026-09-30
+
+Version 1.3.0 follows version 1.2.2, and no version stands between them. The date of the
+heading above is the date this release reaches `master`. It carries rounds 268 and 269.
+
+**The bump is minor and never patch.** This release adds published names: the
+`ja4plus.scan` package, the `ja4plus scan` subcommand and the `scan` extra. It removes no
+name and it renames none.
+
+**JA4 reads a ClientHello that spans TCP segments** (#772). A post-quantum key share makes
+a current browser ClientHello longer than one TCP segment, and the fingerprinter read each
+segment alone, so it wrote no JA4 value for such a hello. **A caller now receives a JA4
+value for that traffic where it received none before.** The fingerprinter holds the client
+payload of a connection in a bounded table until the hello is complete, and a gap stops
+the read at the first byte that has not arrived.
+
+**Two readers now write the FoxIO value.**
+
+| Method | Input | Version 1.2.2 | Version 1.3.0 | Issue |
+|---|---|---|---|---|
+| JA4 | A ClientHello with a GREASE value among its signature algorithms | Hashes the GREASE value | Removes it, as FoxIO `d66336ef` does | #773 |
+| JA4T, JA4TS | A SYN or SYN-ACK with a repeated MSS option or window scale option | Keeps the first value | Keeps the last value, as the FoxIO Rust, Wireshark and Zeek sources do | #774 |
+
+**No value of the committed corpus moves.** A replay of 77 captures writes one new value,
+the JA4 of `sigalg-grease.pcapng` frame 5, which equals the FoxIO value. Every other value
+is byte-identical. No committed capture carries a repeated TCP option or a signature
+algorithm GREASE value.
+
+**`ja4plus scan` adds JA4TScan, the FoxIO active TCP server fingerprint** (#775, #776). The
+scanner sends one SYN to each IPv4 target and reads the SYN-ACK and its retransmissions.
+**It is the one part of the package that sends packets**, so it lives behind the `scan`
+extra and no passive module imports it. **The library changes no firewall state**, and
+the command prints the rules the operator adds. `docs/specs/features/12-active-scan.md`
+states the requirements. The project now implements all twelve FoxIO methods.
+
+**The FoxIO pin moves from `27f0cbf9` to `16b96d95`**, and `sigalg-grease.pcapng` joins the
+vectors. The conformance suite reports 1684 passed, 142 skipped and 138 xfailed at version
+1.2.2, and 1702 passed, 145 skipped and 137 xfailed here.
+
 ## [1.2.2] - 2026-09-29
 
 Version 1.2.2 follows version 1.2.1, and no version stands between them. The date of the

{ja4plus-1.2.2 → ja4plus-1.4.0}/CLAUDE.md

@@ -4,7 +4,7 @@
 produces JA4+ fingerprints. FoxIO publishes the JA4+ standard. This project is an
 independent implementation of it.
 
-This repository declares version 1.2.2, and `ja4plus/__init__.py:101` holds that one
+This repository declares version 1.4.0, and `ja4plus/__init__.py:101` holds that one
 declaration. A publish to PyPI is a separate step, and the maintainer runs it.
 
 Design lives in `docs/specs/`. Read `docs/specs/spec.md` and the relevant

{ja4plus-1.2.2 → ja4plus-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ja4plus
-Version: 1.2.2
+Version: 1.4.0
 Summary: JA4+ network fingerprinting library for TLS, TCP, HTTP, SSH, X.509, and DHCP analysis
 License: BSD-3-Clause AND LicenseRef-FoxIO-1.1
 Project-URL: Homepage, https://github.com/Crank-Git/ja4plus
@@ -41,6 +41,7 @@ Requires-Dist: mkdocs-material==9.7.7; extra == "docs"
 Requires-Dist: mkdocstrings==1.0.6; extra == "docs"
 Requires-Dist: mkdocstrings-python==2.0.9; extra == "docs"
 Requires-Dist: griffe==2.3.0; extra == "docs"
+Provides-Extra: scan
 Dynamic: license-file
 
 <p align="center"><img src="assets/logo.png" width="300"></p>
@@ -49,9 +50,10 @@ A Python library and command-line program that produces JA4+ fingerprints. It re
 TCP, HTTP, SSH and DHCP traffic, and it reads an X.509 certificate. It supports QUIC,
 IPv4, IPv6 and multi-segment TCP reassembly.
 
-**FoxIO publishes twelve JA4+ methods, and this project implements eleven of them.** The
-twelfth is JA4TScan. `Methods` below names each method, and it states whether this
-project builds it.
+**FoxIO publishes twelve JA4+ methods, and this project implements twelve of them.**
+Eleven read traffic that already exists. The twelfth is JA4TScan, which sends packets, and
+the `ja4plus scan` subcommand runs it. Ten fingerprinter classes carry the other eleven,
+because `JA4LFingerprinter` writes both JA4L and JA4LS. `Methods` below names each method.
 
 FoxIO owns the JA4+ standard, and [FoxIO](https://foxio.io) publishes it. This library is
 an independent implementation of that standard. FoxIO wrote no part of it. For the
@@ -80,16 +82,19 @@ The `Implemented` column states whether this project builds the method.
 | JA4SSH | SSH | Session type classification from traffic patterns | Yes |
 | JA4T | TCP | Client OS fingerprint from SYN packets | Yes |
 | JA4TS | TCP | Server fingerprint from SYN-ACK packets | Yes |
-| JA4TScan | TCP | Active TCP fingerprint scanner | No |
+| JA4TScan | TCP | Active TCP server fingerprint from SYN-ACK retransmissions, through `ja4plus scan` | Yes |
 | JA4D | DHCPv4 | DHCP client/server fingerprint (FoxIO PR #267/#270) | Yes |
 | JA4D6 | DHCPv6 | DHCPv6 client/server fingerprint (FoxIO PR #267/#270) | Yes |
 
-**JA4TScan is declined by ruling, and it is not an omission.** It sends crafted packets
-to a host the operator names and reads the responses. Every other method reads traffic
-that already exists, so JA4TScan reaches a network the operator did not capture. That
-capability is larger than fingerprint production.
-[`docs/specs/spec.md`](docs/specs/spec.md) holds the ruling under `Non-goals`, and the
-ruling is reversible.
+**JA4TScan sends packets, so this project keeps it apart from the other eleven.** It
+sends one TCP SYN to each host the operator names and reads the responses. The maintainer
+reversed the decline of 2026-08-08 on 2026-09-30, in #775, and #776 built the scanner.
+The scanner installs with `pip install ja4plus[scan]` and runs as `ja4plus scan`. The
+`ja4plus.scan` module holds it, and no passive fingerprinter can send a packet. The
+scanner changes no firewall state, and it states the rule the operator adds.
+[`docs/methods/ja4tscan.md`](docs/methods/ja4tscan.md) describes the command, and
+[`docs/specs/features/12-active-scan.md`](docs/specs/features/12-active-scan.md) holds the
+design.
 
 `JA4LFingerprinter` builds both JA4L and JA4LS, so ten fingerprinters carry eleven
 methods. `--types ja4l` names the two together, and `--types ja4ls` names JA4LS alone.
@@ -535,7 +540,7 @@ pytest tests/ -v
 
 This library is released under the **BSD 3-Clause License**.
 
-The JA4+ fingerprinting specifications were created by [FoxIO](https://foxio.io). JA4 (TLS Client) is open source under BSD-3-Clause per FoxIO. The other methods this project implements carry the [FoxIO License 1.1](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE): JA4S, JA4H, JA4L, JA4LS, JA4X, JA4SSH, JA4T, JA4TS, JA4D and JA4D6. That license is permissive for academic, internal business, and security research use. FoxIO names each of them at line 5 of [`License FAQ.md`](https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md), at commit `27f0cbf9fd3000c072f82a0f7d0361dc99acf6c8`. That FoxIO list is wider than this one, because it also names methods this project does not implement.
+The JA4+ fingerprinting specifications were created by [FoxIO](https://foxio.io). JA4 (TLS Client) is open source under BSD-3-Clause per FoxIO. The other methods this project implements carry the [FoxIO License 1.1](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE): JA4S, JA4H, JA4L, JA4LS, JA4X, JA4SSH, JA4T, JA4TS, JA4TScan, JA4D and JA4D6. That license is permissive for academic, internal business, and security research use. FoxIO names each of them at line 5 of [`License FAQ.md`](https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md), at commit `27f0cbf9fd3000c072f82a0f7d0361dc99acf6c8`. That FoxIO list is wider than this one, because it also names methods this project does not implement.
 
 See [LICENSE](LICENSE) for full details.
 

{ja4plus-1.2.2 → ja4plus-1.4.0}/README.md

@@ -4,9 +4,10 @@ A Python library and command-line program that produces JA4+ fingerprints. It re
 TCP, HTTP, SSH and DHCP traffic, and it reads an X.509 certificate. It supports QUIC,
 IPv4, IPv6 and multi-segment TCP reassembly.
 
-**FoxIO publishes twelve JA4+ methods, and this project implements eleven of them.** The
-twelfth is JA4TScan. `Methods` below names each method, and it states whether this
-project builds it.
+**FoxIO publishes twelve JA4+ methods, and this project implements twelve of them.**
+Eleven read traffic that already exists. The twelfth is JA4TScan, which sends packets, and
+the `ja4plus scan` subcommand runs it. Ten fingerprinter classes carry the other eleven,
+because `JA4LFingerprinter` writes both JA4L and JA4LS. `Methods` below names each method.
 
 FoxIO owns the JA4+ standard, and [FoxIO](https://foxio.io) publishes it. This library is
 an independent implementation of that standard. FoxIO wrote no part of it. For the
@@ -35,16 +36,19 @@ The `Implemented` column states whether this project builds the method.
 | JA4SSH | SSH | Session type classification from traffic patterns | Yes |
 | JA4T | TCP | Client OS fingerprint from SYN packets | Yes |
 | JA4TS | TCP | Server fingerprint from SYN-ACK packets | Yes |
-| JA4TScan | TCP | Active TCP fingerprint scanner | No |
+| JA4TScan | TCP | Active TCP server fingerprint from SYN-ACK retransmissions, through `ja4plus scan` | Yes |
 | JA4D | DHCPv4 | DHCP client/server fingerprint (FoxIO PR #267/#270) | Yes |
 | JA4D6 | DHCPv6 | DHCPv6 client/server fingerprint (FoxIO PR #267/#270) | Yes |
 
-**JA4TScan is declined by ruling, and it is not an omission.** It sends crafted packets
-to a host the operator names and reads the responses. Every other method reads traffic
-that already exists, so JA4TScan reaches a network the operator did not capture. That
-capability is larger than fingerprint production.
-[`docs/specs/spec.md`](docs/specs/spec.md) holds the ruling under `Non-goals`, and the
-ruling is reversible.
+**JA4TScan sends packets, so this project keeps it apart from the other eleven.** It
+sends one TCP SYN to each host the operator names and reads the responses. The maintainer
+reversed the decline of 2026-08-08 on 2026-09-30, in #775, and #776 built the scanner.
+The scanner installs with `pip install ja4plus[scan]` and runs as `ja4plus scan`. The
+`ja4plus.scan` module holds it, and no passive fingerprinter can send a packet. The
+scanner changes no firewall state, and it states the rule the operator adds.
+[`docs/methods/ja4tscan.md`](docs/methods/ja4tscan.md) describes the command, and
+[`docs/specs/features/12-active-scan.md`](docs/specs/features/12-active-scan.md) holds the
+design.
 
 `JA4LFingerprinter` builds both JA4L and JA4LS, so ten fingerprinters carry eleven
 methods. `--types ja4l` names the two together, and `--types ja4ls` names JA4LS alone.
@@ -490,7 +494,7 @@ pytest tests/ -v
 
 This library is released under the **BSD 3-Clause License**.
 
-The JA4+ fingerprinting specifications were created by [FoxIO](https://foxio.io). JA4 (TLS Client) is open source under BSD-3-Clause per FoxIO. The other methods this project implements carry the [FoxIO License 1.1](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE): JA4S, JA4H, JA4L, JA4LS, JA4X, JA4SSH, JA4T, JA4TS, JA4D and JA4D6. That license is permissive for academic, internal business, and security research use. FoxIO names each of them at line 5 of [`License FAQ.md`](https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md), at commit `27f0cbf9fd3000c072f82a0f7d0361dc99acf6c8`. That FoxIO list is wider than this one, because it also names methods this project does not implement.
+The JA4+ fingerprinting specifications were created by [FoxIO](https://foxio.io). JA4 (TLS Client) is open source under BSD-3-Clause per FoxIO. The other methods this project implements carry the [FoxIO License 1.1](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE): JA4S, JA4H, JA4L, JA4LS, JA4X, JA4SSH, JA4T, JA4TS, JA4TScan, JA4D and JA4D6. That license is permissive for academic, internal business, and security research use. FoxIO names each of them at line 5 of [`License FAQ.md`](https://github.com/FoxIO-LLC/ja4/blob/main/License%20FAQ.md), at commit `27f0cbf9fd3000c072f82a0f7d0361dc99acf6c8`. That FoxIO list is wider than this one, because it also names methods this project does not implement.
 
 See [LICENSE](LICENSE) for full details.
 

{ja4plus-1.2.2 → ja4plus-1.4.0}/docs/api_reference.md

@@ -280,7 +280,7 @@ dataclass, because a result describes something that already happened.
 
 | Field | Type | Constraint |
 |---|---|---|
-| `type` | `str` | The method name, lowercase. One of ten values, and ten values carry eleven methods. `--types` accepts these ten tokens and the token `ja4ls`. |
+| `type` | `str` | The method name, lowercase. One of eleven values. Ten values carry the eleven passive methods, and `ja4plus scan` writes the value `ja4tscan`. `--types` accepts the ten passive tokens and the token `ja4ls`. |
 | `fingerprint` | `str` | The fingerprint string. Never empty. |
 | `raw` | `str \| None` | The raw form, when the method defines one. |
 | `raw_original_order` | `str \| None` | The original-order raw form, when the method defines one. |
@@ -382,8 +382,8 @@ log the error inside the loop that reads it.
 reads no packet timestamp. The field holds `None`.
 
 `stats()` reports what the state tables hold, and #41 built it. One processor holds
-**seventeen** state tables across the ten fingerprinters: the fifteen `BoundedStateTable`
-instances and the two `TCPStreamReassembler` instances of JA4H and JA4X. A method that
+**eighteen** state tables across the ten fingerprinters: the fifteen `BoundedStateTable`
+instances and the three `TCPStreamReassembler` instances of JA4H, JA4X and JA4 (#772). A method that
 holds no state reports an empty `tables` list.
 
 | Field of `ProcessorStats` | Description |
@@ -435,8 +435,8 @@ one processor without that arrangement, and it guards a `reset` that runs beside
 
 #### The memory bound of the processor
 
-One processor holds seventeen state tables: fifteen `BoundedStateTable` instances and
-two `TCPStreamReassembler` instances. `features/03-concurrency-safety.md` states the maximum
+One processor holds eighteen state tables: fifteen `BoundedStateTable` instances and
+three `TCPStreamReassembler` instances. `features/03-concurrency-safety.md` states the maximum
 entry count and the maximum age of each one. A table that reaches its maximum entry count
 evicts the least recently used entry. A long capture can therefore evict a connection
 that later returns, and the fingerprint of a returned connection may be incomplete.
@@ -546,11 +546,11 @@ caller removed with `cleanup_connection` counts as a first sighting when it retu
 because the caller asked for that removal.
 
 A table remembers the keys it evicted, so that it can recognize a return. The memory
-holds the entry bound of its own table. The seventeen tables of one processor hold 57400
-remembered keys between them, at 187 bytes for one key, so the memory costs 10.2 MiB
+holds the entry bound of its own table. The eighteen tables of one processor hold 58400
+remembered keys between them, at 187 bytes for one key, so the memory costs 10.4 MiB
 when every table is full and every entry of every table has been replaced.
 
-Ten fingerprinters hold seventeen state tables between them. `JA4DFingerprinter` and
+Ten fingerprinters hold eighteen state tables between them. `JA4DFingerprinter` and
 `JA4D6Fingerprinter` hold none, and each reports an empty `tables` dict.
 
 `stats()` holds the lock of one fingerprinter across the read of that fingerprinter, so
@@ -562,6 +562,61 @@ tables that the counts describe.
 
 `ProcessorStats` is a plain object. Epic 4 makes it a typed dataclass.
 
+## Active scan
+
+`ja4plus.scan` holds JA4TScan, the one method that sends packets. `import ja4plus` loads
+no module of it, and no module outside it imports it. The `ja4plus scan` subcommand
+reaches it through the `ja4plus.commands` entry point.
+[The JA4TScan page](methods/ja4tscan.md) describes the command.
+
+**The scan loop takes the send function, the receive function and the clock as
+parameters.** A caller therefore runs it on a fake network, and `tests/scan_fakes.py`
+holds one.
+
+### ja4plus.scan.value
+
+| Class/Function | Description |
+|---|---|
+| `Response(seconds, flags, window, options)` | The four fields of one TCP response that the value reads |
+| `ja4tscan_value(responses)` | Return the JA4TScan value of one target, or `None` when it sent no response |
+| `RST_ACK_VALUE` | The value `0_rst-ack`, which a target whose first response carries RST produces |
+
+### ja4plus.scan.frames
+
+| Class/Function | Description |
+|---|---|
+| `build_syn(*, src_mac, dst_mac, src_ip, dst_ip, src_port, dst_port, sequence, timestamp)` | Return the Ethernet frame of one FoxIO SYN, 74 bytes |
+| `parse_frame(frame)` | Return the TCP fields of one received Ethernet frame, or `None` for a frame it cannot read |
+| `Reply` | The TCP fields of one received segment that the scanner reads |
+
+### ja4plus.scan.scanner
+
+| Class/Function | Description |
+|---|---|
+| `Scanner(*, port, rate, retransmit, send, receive, clock, on_result, on_warning, rng)` | The scan loop. `run(targets)` sends one SYN to each target and waits for its responses |
+| `ScanResult` | The value of one target and the endpoints of its responses |
+| `parse_targets(text)` | Return the IPv4 targets that one address, one network or one file names |
+| `TargetError` | The error `parse_targets` raises for a target the scanner cannot read |
+| `firewall_rules(platform)` | Return the firewall rules the operator adds before a scan |
+| `MAX_TARGETS` | The largest target count the state table holds, 10000 |
+| `RETRANSMIT_WAIT_SECONDS` | The wait for later responses after each SYN, 120 seconds |
+| `NO_RETRANSMIT_WAIT_SECONDS` | The wait under `--retransmit no`, 8 seconds |
+
+### ja4plus.scan.command
+
+| Class/Function | Description |
+|---|---|
+| `run(args, result_stream)` | Run the scan on the network of this host. The `ja4plus.commands` entry point names it |
+| `scan_command(args, *, result_stream, platform, open_network, clock, rng)` | Run the scan over the network that `open_network` returns |
+| `METHOD_TYPE` | The `type` value of a scan output line, `ja4tscan` |
+
+### ja4plus.scan.link
+
+| Class/Function | Description |
+|---|---|
+| `LinkNetwork(port, first_target, on_warning)` | The link-layer socket that sends each SYN and reads each response. It needs the privilege to open a raw socket |
+| `privilege_refused(error)` | Return `True` when the error states that the host refused that privilege |
+
 ## Utility Modules
 
 ### ja4plus.utils.tls_utils

{ja4plus-1.2.2 → ja4plus-1.4.0}/docs/implementation_notes.md

@@ -98,16 +98,17 @@ a FoxIO vector holds the value, and because a fingerprint exists so that one too
 can be compared against another tool output. The register holds no entry for this vector,
 and `tests/test_ja4_alpn.py` compares the produced value against the reference value.
 
-`compute_alpn_value` returns `99` when the first byte or the last byte of the first ALPN
-value falls outside `0x20-0x7E`. `ja4s.py` reads the same function, so JA4 and JA4S
-carry one rule.
+`compute_alpn_value` writes `9` for each end byte of `0x80` or higher, and it writes `99`
+when a control byte sits at either end. The ruling of #789 set that rule on 2026-10-01 UTC,
+and the section `### The ruling of #789 writes 9 for each high end byte` below states it.
+`ja4s.py` reads the same function, so JA4 and JA4S carry one rule.
 
 #127 settled the value that this vector produces. It settled no condition, because
 every rule fires on `0xba 0xad`. #141 measured the condition against a capture it built.
 The next section holds that measurement, and it holds the part of the condition the
 measurement leaves open.
 
-**Location:** `ja4plus/fingerprinters/ja4.py:36`, in `compute_alpn_value`.
+**Location:** `ja4plus/fingerprinters/ja4.py:74`, in `compute_alpn_value`.
 
 ### The ALPN condition passes a printable ASCII byte through
 
@@ -220,10 +221,48 @@ in its invariant field.
 `test_every_stream_differs_from_the_others_in_the_alpn_characters_alone` proves the
 invariance.
 
-**Location:** `ja4plus/fingerprinters/ja4.py:36`, in `compute_alpn_value`. #162 changed
+**Location:** `ja4plus/fingerprinters/ja4.py:74`, in `compute_alpn_value`. #162 changed
 no line of it. `tests/test_ja4_alpn_condition.py` holds the measurement against
 `ja4plus`.
 
+**The tables above record the state before #789.** The next section states the values
+that `ja4plus` writes since that ruling.
+
+### The ruling of #789 writes 9 for each high end byte
+
+**The maintainer ruled on 2026-10-01 UTC, and the ruling binds both repositories.**
+`Crank-Git/ja4plus-go#801` holds the Go half, and the Go library ships it in `v1.3.0`.
+
+- Each end byte of `0x80` or higher writes `9`, one per end.
+- A one-byte printable value writes the byte twice.
+- A control byte below `0x20`, or the byte `0x7F`, at either end still writes `99`.
+
+The ruling follows `python/ja4.py:156-157` and `rust/ja4/src/tls.rs:635-647` at the
+pinned commit `16b96d95`. At that commit FoxIO Python tests each end character against
+128, and it no longer tests the first character alone.
+
+| The first ALPN value | Before #789 | Since #789 |
+|---|---|---|
+| `68` | `hh` | `hh` |
+| `2d` | `99` | `--` |
+| `20` | `99` | two spaces |
+| `68 ff` | `99` | `h9` |
+| `ff 68` | `99` | `9h` |
+| `ba ad` | `99` | `99` |
+| `68 1f` | `99` | `99` |
+| `01 68` | `99` | `99` |
+
+**Two streams of `alpn-condition.pcap` move.** Stream 2 (`h\xab`) now writes `h9`, and
+stream 3 (`\xabh`) now writes `9h`. Both values equal the FoxIO Rust measurement. The
+expected-output file holds the FoxIO Python measurement at `27f0cbf9`, so both streams
+differ from it. The register holds four entries for each stream under #789. **No FoxIO
+vector moves**, because `tls-non-ascii-alpn.pcapng` holds `ba ad` and it still writes `99`.
+
+`tests/test_alpn_end_byte_ruling.py` builds a ClientHello and a ServerHello for each input,
+so it holds the ruling for JA4 and for JA4S.
+
+**Location:** `ja4plus/fingerprinters/ja4.py:57`, in `_alpn_end_character`.
+
 ### The QUIC reference value comes from the FoxIO Rust implementation
 
 `tests/foxio_vectors/quic-with-several-tls-frames.pcapng` holds one QUIC Initial packet.
@@ -300,17 +339,23 @@ reported green on a comparison it never made. #216 closed it, and
 | Measurement | Count |
 |---|---|
 | JA4T values in `python/test/testdata/` | 0 |
-| JA4T values in the seven local Rust snapshots that hold one | 39 |
-| Values `ja4plus` reproduces exactly | 38 |
-| Values that differ | 1 |
+| JA4T values in the eight local Rust snapshots that hold one | 40 |
+| Values `ja4plus` reproduces exactly | 40 |
+| Values that differ | 0 |
 | Streams on which `ja4plus` emits more than one value | 0 |
-| Cases that stop running when `("JA4T", "ja4t")` leaves `SNAPSHOT_METHODS` | 46 |
+| Cases that stop running when `("JA4T", "ja4t")` leaves `SNAPSHOT_METHODS` | 44 |
+
+**#772 took the four counts above again on 2026-09-30, after it moved the pin of
+`tests/foxio_vectors/` to FoxIO `16b96d95`.** `sigalg-grease.pcapng` adds one snapshot and
+one value. The last count is the drop in the collected cases of
+`tests/test_foxio_rust_parity.py` when the JA4T entry leaves `SNAPSHOT_METHODS`.
 
-**The one entry.** `tests/foxio_deviations.json` holds one JA4T key today, and it is
-`gre-erspan-vxlan.pcap/0:65174/JA4T.1`. The FoxIO Rust snapshot holds `8192__0_0` and
-`ja4plus` writes `8192_00_00_00`. The SYN carries no TCP option, and the three FoxIO forms
-disagree. The user chose the two-digit form on 2026-08-08, so the entry is `decided` and it
-stays. #215 records the ruling.
+**The register holds no JA4T key.** It held one until #772, which was
+`gre-erspan-vxlan.pcap/0:65174/JA4T.1`. The FoxIO Rust snapshot held `8192__0_0` at the
+earlier pin, and `ja4plus` writes `8192_00_00_00`. The user chose the two-digit form on
+2026-08-08, and #215 records the ruling. FoxIO `08617cc3` moved the Rust implementation to
+the same form, so the snapshot at `16b96d95` holds `8192_00_00_00` and #772 removed the
+entry.
 
 **Two entries this section named have gone, and the repairs removed them.**
 `chrome-cloudflare-quic-with-secrets.pcapng/0:57098/JA4T.1` recorded a part b that held one
@@ -540,7 +585,7 @@ value. #132 holds the command and the full output.
 Before #132, `ja4plus` emitted `9af15b336e6a` on these four streams. `JA4_o` now matches
 all 160 reference values, and the count was 156 of 160.
 
-**Location:** `ja4plus/fingerprinters/ja4.py:226`.
+**Location:** `ja4plus/fingerprinters/ja4.py:228`.
 
 The JA4S section below records the `JA4S_o` reading.
 

{ja4plus-1.2.2 → ja4plus-1.4.0}/docs/methods/index.md

@@ -1,6 +1,8 @@
 # The methods
 
-FoxIO publishes twelve JA4+ methods. This project implements eleven of them.
+FoxIO publishes twelve JA4+ methods. This project implements twelve of them. Ten
+fingerprinter classes carry eleven of them, because `JA4LFingerprinter` writes both JA4L
+and JA4LS. The `ja4plus scan` subcommand carries JA4TScan.
 
 Each page below describes one method. It states the output format, the parts of the
 value, the hash rule, and the FoxIO file that publishes the method. It also names one
@@ -23,7 +25,7 @@ the standard itself, read the
 | JA4SSH | SSH | [The SSH session fingerprint](ja4ssh.md) | Yes |
 | JA4T | TCP | [The TCP client fingerprint](ja4t.md) | Yes |
 | JA4TS | TCP | [The TCP server fingerprint](ja4ts.md) | Yes |
-| JA4TScan | TCP | No page. Read the decline below. | No |
+| JA4TScan | TCP | [The active TCP server fingerprint](ja4tscan.md) | Yes |
 | JA4D | DHCPv4 | [The DHCPv4 fingerprint](ja4d.md) | Yes |
 | JA4D6 | DHCPv6 | [The DHCPv6 fingerprint](ja4d6.md) | Yes |
 
@@ -40,15 +42,24 @@ under parity rule 2.
 **Read the ten as a count of fingerprinter classes, and never as a count of methods.**
 #387 records the three documents that made that mistake.
 
-## Why this project builds no JA4TScan
+## Why JA4TScan stands apart from the other methods
 
-**This project declines JA4TScan by ruling, and the absence is no omission.** JA4TScan
-sends crafted packets to a host the operator names, and it reads the responses. Every
-other method reads traffic that already exists, so JA4TScan reaches a network the
-operator did not capture. That capability is larger than fingerprint production.
+**JA4TScan sends packets, and every other method reads traffic that already exists.**
+JA4TScan sends one TCP SYN to each host the operator names, and it reads the responses.
+#776 built it as the `ja4plus scan` subcommand, in the `ja4plus.scan` module. No
+fingerprinter of this table can send a packet.
 
-`docs/specs/spec.md` holds the ruling under `Non-goals`, and #197 holds the reading.
-The ruling is reversible.
+The maintainer reversed the decline of 2026-08-08 on 2026-09-30, in #775.
+`docs/specs/features/12-active-scan.md` holds the design, and [the JA4TScan page](ja4tscan.md)
+describes the command. The superseded text is quoted below rather than rewritten.
+
+> **This project declines JA4TScan by ruling, and the absence is no omission.** JA4TScan
+> sends crafted packets to a host the operator names, and it reads the responses. Every
+> other method reads traffic that already exists, so JA4TScan reaches a network the
+> operator did not capture. That capability is larger than fingerprint production.
+>
+> `docs/specs/spec.md` holds the ruling under `Non-goals`, and #197 holds the reading.
+> The ruling is reversible.
 
 ## What a fingerprint is evidence of