[Zeek] ja3 & ja3s with resumed tls
Johanna Amann
johanna at icir.org
Thu Jan 10 06:40:35 PST 2019
Hi Daniel,
unless I am missing something, there should be no difference in the
signature of a resumed and a new connection for JA3. I don’t remember
them hashing anything in that has to do with session resumption.
Johanna
On 10 Jan 2019, at 5:02, Daniel Guerra wrote:
> Hi,
>
> I'm researching ja3 and ja3s tls signatures.
>
> With resumed tls connections there is no complete
>
> handshake etc. Does it make sense to calculate a ja3
>
> on resumed tls ?
>
> Regards,
>
> Daniel
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
More information about the Zeek
mailing list