[Zeek] ja3 & ja3s with resumed tls

Johanna Amann johanna at icir.org
Thu Jan 10 06:40:35 PST 2019


Hi Daniel,

unless I am missing something, there should be no difference in the 
signature of a resumed and a new connection for JA3. I don’t remember 
them hashing anything in that has to do with session resumption.

Johanna


On 10 Jan 2019, at 5:02, Daniel Guerra wrote:

> Hi,
>
> I'm researching ja3 and ja3s tls signatures.
>
> With resumed tls connections there is no complete
>
> handshake etc. Does it make sense to calculate a ja3
>
> on resumed tls ?
>
> Regards,
>
> Daniel
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek


More information about the Zeek mailing list