Advanced Labs
JA4S Intermediate

JA4Server (JA4S - TLS Server Response / Session Fingerprinting)

Short Name: JA4S

Description: JA4S focuses on fingerprinting TLS server responses and session characteristics. By analyzing server response times, jitter, packet loss, and TLS configurations, JA4S generates unique fingerprints that help in identifying and validating servers, detecting anomalies, and optimizing server performance.

Understanding JA4S Components

Components of a JA4S Fingerprint:

  1. Server Response Time (SRT): • Description: The average time taken by the server to respond to client requests. • Purpose: Indicates the server’s responsiveness and overall performance. • Example: 30 ms
  2. Server Jitter: • Description: The variability in server response times. • Purpose: High jitter may indicate server-side instability or fluctuating network conditions. • Example: 3 ms
  3. Server Packet Loss: • Description: The percentage of packets lost during communication between the client and server. • Purpose: High packet loss can degrade server performance and indicate network issues. • Example: 0.7%
  4. Server Queue Delay: • Description: Delay caused by server-side queuing or processing bottlenecks. • Purpose: Identifies potential resource constraints or high load on the server. • Example: 4 ms
  5. Server TTL (Time To Live): • Description: The TTL value in the server’s response packets. • Purpose: Can provide hints about the server’s operating system or network configuration. • Example: 64
  6. Server Window Size: • Description: The TCP window size used by the server. • Purpose: Indicates the server’s capacity to handle data flow. • Example: 65535
  7. TLS Session Properties: • Description: Specific properties of the TLS session, such as supported cipher suites, TLS versions, and session resumption capabilities. • Purpose: Provides a detailed profile of the server’s TLS capabilities and configurations. • Example: TLSv1.3, Cipher Suites: TLS_AES_256_GCM_SHA384, Session Resumption: Supported

Measuring Server-to-Client Latency

Techniques:

  1. Using Server Logs: • Description: Parse server logs to extract response times. • Example: • Apache Log Entry with Response Time:
127.0.0.1 - - [12/Oct/2024:15:12:17 +0000] "GET /index.html HTTP/1.1" 200 305 "-" "Mozilla/5.0" 0.150

• Explanation: The last value (0.150) indicates the response time in seconds.

  1. Using Network Monitoring Tools: • Description: Utilize tools like Pingdom or Updown.io to monitor server response times from different locations. • Example: • Pingdom Setup: • Configure Pingdom to monitor your server’s URL at regular intervals. • Collect and analyze response time metrics.
  2. Using Zeek: • Description: Use Zeek’s conn.log to extract resp_rtt. • Example Zeek Script:
event connection_established(c: connection) {
    print fmt("Connection Established: %s -> %s, Resp RTT: %f ms", 
        c$id$resp_h, c$id$orig_h, c$resp_rtt * 1000);
}
  1. Using Python Script with Scapy: • Description: Send custom packets and measure response times. • Example Python Script:
from scapy.all import sr1, IP, TCP
import time
 
def measure_latency(host, port=443):
    packet = IP(dst=host)/TCP(dport=port, flags='S')
    start_time = time.time()
    response = sr1(packet, timeout=2, verbose=0)
    if response and response.haslayer(TCP):
        latency = (time.time() - start_time) * 1000  # Convert to ms
        print(f"Latency to {host}:{port} - {latency:.2f} ms")
        return latency
    else:
        print(f"No response from {host}:{port}")
        return None
 
measure_latency("example.com")
  1. Using iPerf for Server-Client Measurement: • Description: Measure network performance metrics. • Example:
# On Server
iperf3 -s
 
# On Client
iperf3 -c <server_ip> -t 10

• Explanation: • The server listens for incoming connections. • The client initiates a test to measure network performance for 10 seconds.

Calculating Server Jitter and Packet Loss

  1. Calculating Server Jitter: • Description: Jitter is calculated as the standard deviation of server response times. • Example Calculation in Python:
import statistics
 
response_times = [30, 32, 29, 31, 33]  # in ms
jitter = statistics.stdev(response_times)
print(f"Server Jitter: {jitter:.2f} ms")

Output:

Server Jitter: 1.58 ms
  1. Calculating Server Packet Loss: • Description: Packet loss is calculated as the percentage of packets not acknowledged by the client. • Formula:
Server Packet Loss (%) = (Lost Packets / Total Packets) * 100

• Example Calculation: • If out of 200 packets sent, 1.4 packets are lost:

Packet Loss = (1.4 / 200) * 100 = 0.7%

Calculating Server Queue Delay

Description: Queue delay can be inferred by comparing expected response time with actual response time.

Example Calculation:

• Expected Response Time: 25 ms • Actual Response Time: 30 ms • Queue Delay: 30 ms - 25 ms = 5 ms

Explanation:

• The actual response time exceeds the expected response time by 5 ms, indicating a queue delay.

Constructing the JA4S Fingerprint

Steps:

  1. Create the Fingerprint String: • Format:
srt<average_srt>_sj<server_jitter>_spl<server_packet_loss>_sq<server_queue_delay>_sttl<server_ttl>_swin<server_window_size>_tls<tls_session_properties>

• Example:

srt30_sj3_spl0.7_sq4_sttl64_swin65535_tlsTLSv1.3_TLS_AES_256_GCM_SHA384,SessionResumptionSupported

  1. Hash the Fingerprint (Optional): • Use a hash function like SHA-256 to hash the fingerprint string for privacy or storage purposes.

  2. Hashing Components: • To ensure uniqueness and privacy, certain components like TLS session properties can be hashed using a cryptographic hash function (e.g., SHA-256). • Example Hash Function in Python:

import hashlib
 
def generate_hash(component):
    """Generates a SHA-256 hash of the given component and truncates it."""
    return hashlib.sha256(component.encode()).hexdigest()[:8]
 
tls_properties = "TLSv1.3,TLS_AES_256_GCM_SHA384,SessionResumptionSupported"
tls_hash = generate_hash(tls_properties)  # e.g., 'e4f1a2b3'
  1. Example Fingerprint Construction: • Sample Server Data: • Average SRT: 30 ms • Server Jitter: 3 ms • Server Packet Loss: 0.7% • Server Queue Delay: 4 ms • Server TTL: 64 • Server Window Size: 65535 • TLS Session Properties: TLSv1.3,TLS_AES_256_GCM_SHA384,Session Resumption Supported • Fingerprint Construction:
tls_hash = generate_hash(tls_properties)  # e.g., 'e4f1a2b3'
srt30_sj3_spl0.7_sq4_sttl64_swin65535_tls_e4f1

Usage Example

Scenario: You want to validate a server’s identity and monitor its performance over time.

Steps:

  1. Collect Server Metrics: • Use the measurement techniques outlined above to collect SRT, jitter, packet loss, queue delay, TTL, window size, and TLS session properties.
  2. Generate Fingerprint: • Construct the fingerprint string using the collected metrics. • Hash sensitive components like TLS session properties.
  3. Store Fingerprint: • Save the fingerprint in your centralized analysis database for future comparisons.
  4. Validate Server: • When a server connects, generate its current fingerprint. • Compare it against the stored fingerprints to validate its identity. • Detect any anomalies or changes that may indicate security issues.

Example Output:

JA4S Fingerprint: srt30_sj3_spl0.7_sq4_sttl64_swin65535_tls_e4f1

Integration Guidelines

JA4S can be integrated with other JA4+ components and external tools to provide a comprehensive network security solution.

  1. Integration with Zeek: • Use Zeek to capture and log TLS session properties. • Feed the logs into JA4S for fingerprint generation.
  2. Integration with Suricata: • Utilize Suricata’s real-time traffic analysis to detect anomalies based on JA4S fingerprints.
  3. Database Integration: • Store JA4S fingerprints in databases like Elasticsearch for efficient querying and analysis. • Example:
curl -X POST "localhost:9200/ja4s_fingerprints/_doc/" -H 'Content-Type: application/json' -d'
{
  "fingerprint": "srt30_sj3_spl0.7_sq4_sttl64_swin65535_tls_e4f1",
  "timestamp": "2024-10-01T12:00:00Z",
  "server_ip": "192.168.1.1"
}
'
  1. Visualization with Kibana: • Use Kibana to create dashboards that visualize JA4S fingerprint data, enabling easy monitoring and anomaly detection. 5. Alerting Mechanisms: • Set up alerts to notify administrators when deviations from known fingerprints are detected, indicating potential security threats or performance issues.

Best Practices

• Regular Updates: • Continuously update fingerprint databases to account for legitimate changes in server configurations. • Baseline Establishment: • Establish baseline fingerprints during normal operations to facilitate accurate anomaly detection. • Secure Storage: • Ensure that fingerprint data is stored securely to prevent tampering and unauthorized access. • Performance Monitoring: • Regularly monitor the performance impact of JA4S on your network and adjust configurations as necessary. • Comprehensive Logging: • Maintain detailed logs of fingerprint generation and validation processes for auditing and troubleshooting purposes.

Conclusion

Continue Advanced For More Information

JA4H IntermediateJA4T Lab