ja3.py
def process_ssl(pkt, any_port=False):
    """Process packets within the PCAP.

    :param pcap: Opened PCAP file to be processed
    :type pcap: dpkt.pcap.Reader
    :param any_port: Whether or not to search for non-SSL ports
    :type any_port: bool
    """
    tls_handshake = pkt

    if tls_handshake[0] != TLS_HANDSHAKE:
        return

    records = list()

    try:
        # records, bytes_used = dpkt.ssl.tls_multi_factory(tcp.data)
        records, bytes_used = dpkt.ssl.tls_multi_factory(tls_handshake)
    except dpkt.ssl.SSL3Exception:
        return
    except dpkt.dpkt.NeedData:
        return

    if len(records) <= 0:
        return

    for record in records:
        if record.type != TLS_HANDSHAKE:
            return
        if len(record.data) == 0:
            return
        client_hello = bytearray(record.data)
        if client_hello[0] != 1:
            # We only want client HELLO
            return
        try:
            handshake = dpkt.ssl.TLSHandshake(record.data)
        except dpkt.dpkt.NeedData:
            # Looking for a handshake here
            return
        if not isinstance(handshake.data, dpkt.ssl.TLSClientHello):
            # Still not the HELLO
            return

        client_handshake = handshake.data
        buf, ptr = parse_variable_array(client_handshake.data, 1)
        buf, ptr = parse_variable_array(client_handshake.data[ptr:], 2)
        ja3 = [str(client_handshake.version)]

        # Cipher Suites (16 bit values)
        ja3.append(convert_to_ja3_segment(buf, 2))
        ja3 += process_extensions(client_handshake)
        ja3 = ",".join(ja3)

        ja3_digest = md5(ja3.encode()).hexdigest()
        # src_ip = convert_ip(ip.src)
        src_ip = None
        # sport = tcp.sport
        sport = None
        record = {
                  "ja3": ja3,
                  "ja3_digest": ja3_digest}

        return record
Process packets within the PCAP.

    :param pcap: Opened PCAP file to be processed
    :type pcap: dpkt.pcap.Reader
    :param any_port: Whether or not to search for non-SSL ports
    :type any_port: bool
    
Process packets within the PCAP.
Process packets within the PCAP .
def process_ssl(pkt, any_port=False):
    tls_handshake = pkt
    if tls_handshake[0] != TLS_HANDSHAKE:
        return
    records = list()
    try:
        records, bytes_used = dpkt.ssl.tls_multi_factory(tls_handshake)
    except dpkt.ssl.SSL3Exception:
        return
    except dpkt.dpkt.NeedData:
        return
    if len(records) <= 0:
        return
    for record in records:
        if record.type != TLS_HANDSHAKE:
            return
        if len(record.data) == 0:
            return
        client_hello = bytearray(record.data)
        if client_hello[0] != 1:
            return
        try:
            handshake = dpkt.ssl.TLSHandshake(record.data)
        except dpkt.dpkt.NeedData:
            return
        if not isinstance(handshake.data, dpkt.ssl.TLSClientHello):
            return
        client_handshake = handshake.data
        buf, ptr = parse_variable_array(client_handshake.data, 1)
        buf, ptr = parse_variable_array(client_handshake.data[ptr:], 2)
        ja3 = [str(client_handshake.version)]
        ja3.append(convert_to_ja3_segment(buf, 2))
        ja3 += process_extensions(client_handshake)
        ja3 = ",".join(ja3)
        ja3_digest = md5(ja3.encode()).hexdigest()
        src_ip = None
        sport = None
        record = {
                  "ja3": ja3,
                  "ja3_digest": ja3_digest}
        return record
def process_ssl ( pkt , any_port = False ) : tls_handshake = pkt if tls_handshake [ 0 ] != TLS_HANDSHAKE : return records = list ( ) try : records , bytes_used = dpkt . ssl . tls_multi_factory ( tls_handshake ) except dpkt . ssl . SSL3Exception : return except dpkt . dpkt . NeedData : return if len ( records ) <= 0 : return for record in records : if record . type != TLS_HANDSHAKE : return if len ( record . data ) == 0 : return client_hello = bytearray ( record . data ) if client_hello [ 0 ] != 1 : return try : handshake = dpkt . ssl . TLSHandshake ( record . data ) except dpkt . dpkt . NeedData : return if not isinstance ( handshake . data , dpkt . ssl . TLSClientHello ) : return client_handshake = handshake . data buf , ptr = parse_variable_array ( client_handshake . data , 1 ) buf , ptr = parse_variable_array ( client_handshake . data [ ptr : ] , 2 ) ja3 = [ str ( client_handshake . version ) ] ja3 . append ( convert_to_ja3_segment ( buf , 2 ) ) ja3 += process_extensions ( client_handshake ) ja3 = "," . join ( ja3 ) ja3_digest = md5 ( ja3 . encode ( ) ) . hexdigest ( ) src_ip = None sport = None record = { "ja3" : ja3 , "ja3_digest" : ja3_digest } return record
Process packets within the PCAP.
Process packets within the PCAP .
"""Process packets within the PCAP.

    :param pcap: Opened PCAP file to be processed
    :type pcap: dpkt.pcap.Reader
    :param any_port: Whether or not to search for non-SSL ports
    :type any_port: bool
    """ # records, bytes_used = dpkt.ssl.tls_multi_factory(tcp.data) # We only want client HELLO # Looking for a handshake here # Still not the HELLO # Cipher Suites (16 bit values) # src_ip = convert_ip(ip.src) # sport = tcp.sport
pkt
any_port
Whether or not to search for non-SSL ports
Whether or not to search for non - SSL ports
pcap
Opened PCAP file to be processed
Opened PCAP file to be processed