[Zeek] ja3 & ja3s with resumed tls

Daniel Guerra daniel.guerra69 at gmail.com
Thu Jan 10 05:02:57 PST 2019


Hi,

I'm researching ja3 and ja3s tls signatures.

With resumed tls connections there is no complete

handshake etc. Does it make sense to calculate a ja3

on resumed tls ?

Regards,

Daniel



More information about the Zeek mailing list