Project

General

Profile

Actions

Support #4435

closed

Seem to be getting wrong hashes for JA3?

Added by Ellie O'Hanlon about 3 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:
Beginner

Description

I am having a problem with Suricata as it does not seem to be reporting the correct JA3 hashes. I am comparing them to the ones I have in Wireshark and the ones in Wireshark are correct. I have JA3 enabled in the YAML config file so I’m unsure as to why I am getting inaccurate hashes. I feel like I have tried a lot of different things - different OS, changing the encryption handling setting etc. I was wondering if anyone could help me with this please as my dissertation is based on investigations using Suricata and JA3.

For example: Suricata (standard chrome browser):
"ja3": {
"hash": "a0f5390b00000000e93b510000000000",
"string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0"
},
"ja3s": {
"hash": "90f5390b00000000e93b510000000000",
"string": "771,4865,51-43"
}

Wireshark (standard chrome browser):
JA3 = b32309a26951912be7dba376398abc3b
JA3 (full) = 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0

JA3S = eb1d94daa7e0344597e756a1fb6e7054
JA3S (full) = 771,4865,51-43

...and then when I put them into https://ja3er.com/, the hashes cannot be found.

My Suricata version is the latest. My machine uses a Windows OS. I have the JA3 setting set to "yes" in my config file and the encryption handling setting is set to "bypass".


Files

suricata (1).yaml (73.1 KB) suricata (1).yaml Ellie O'Hanlon, 04/20/2021 04:36 PM
Actions #1

Updated by Andreas Herz about 3 years ago

  • Tracker changed from Bug to Support
  • Priority changed from Urgent to Normal

Duplicate of https://forum.suricata.io/t/seem-to-be-getting-wrong-hashes-for-ja3/1303/6 feel free to decide where you want to discuss this issue

Actions #2

Updated by Andreas Herz about 2 years ago

  • Status changed from New to Closed

Hi, we're closing this issue since there have been no further responses.
If you think this issue is still relevant, try to test it again with the
most recent version of suricata and reopen the issue. If you want to
improve the bug report please take a look at
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Reporting_Bugs

Actions

Also available in: Atom PDF