[Bro] Mapping TLS scanners JA3 => User-Agent

Neslog neslog at gmail.com
Wed Dec 5 13:45:44 PST 2018


This reiterates some of the concerns we had and why I'm looking at building
this project.  He had some good ideas about clues which are available
within the extension values.  It gave me some ideas on how to apply it and
extend JA3.

Love to hear what others think.  Feel free to ping me directly.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20181205/05067ec3/attachment.html 


More information about the Bro mailing list