Advanced Labs
JA4T Lab

JA4T Lab

Objectives

Learn how to capture network traffic using Wireshark, identify TCP SYN packets, and generate JA4T fingerprints to understand TCP client behaviors.

Tools Required

  • Wireshark: A network protocol analyzer used for network troubleshooting, analysis, and education.

Prerequisites

  • Basic understanding of TCP/IP networking.
  • Administrative access to install and run Wireshark on your machine.

Lab Steps

Step 1: Install Wireshark

Download Wireshark:

  • Navigate to the Wireshark Download Page.
  • Choose the appropriate installer for your operating system (Windows, macOS, Linux).

Install Wireshark:

  • Run the installer and follow the on-screen instructions.
  • For Windows users, ensure you install the "NPcap" packet capture library when prompted.

Step 2: Launch Wireshark and Select Network Interface

Open Wireshark:

  • Double-click the Wireshark icon to launch the application.

Select Network Interface:

  • On the main screen, you will see a list of available network interfaces.
  • Choose the interface that is connected to the internet (e.g., Ethernet, Wi-Fi).

Step 3: Start Packet Capture

Begin Capturing:

  • Double-click on the selected network interface to start capturing packets.

Generate Network Traffic:

  • Open a web browser or any network-enabled application to initiate new TCP connections.
  • Visit various websites to generate traffic.

Step 4: Stop Packet Capture

Stop Capturing:

  • Click the Red Square icon or press Ctrl + E to stop capturing packets after sufficient data has been collected.

Step 5: Filter and Analyze Captured Packets

Apply Display Filter for TCP SYN Packets:

  • In the display filter bar (located just below the toolbar), enter:
tcp.flags.syn == 1 && tcp.flags.ack == 0
  • Press Enter to apply the filter. This will display only TCP SYN packets initiating connections.

Examine Packet Details:

  • Click on a packet in the list to view its details.

  • Expand the "Internet Protocol Version 4" section to find the "Time to live (TTL)" value.

  • Expand the "Transmission Control Protocol" section to view:

  • Source Port and Destination Port

  • Sequence Number

  • Window Size Value

  • TCP Options (if any)

Step 6: Extract TCP Options and Header Information

Locate TCP Options:

  • Within the "Transmission Control Protocol" section, find the "Options" field.
  • Expand "Options" to see the list of TCP options included in the packet.

Record TCP Options and Order:

  • Note down the options and the order they appear. Common options include:
  • Maximum Segment Size (MSS)
  • Window Scale (WS)
  • SACK Permitted
  • Timestamps

Record Window Size and TTL:

  • Window Size Value: Found under the TCP header details.
  • TTL (Time To Live): Found under the IP header details.

Step 7: Construct the JA4T Fingerprint

Format the Fingerprint:

Use the structure:

f<tcp_flags>_o<tcp_options_hash>_ws<window_size>_ttl<ttl>_ip<ip_options_hash>

Determine TCP Flags:

  • For a SYN packet, the flag is S.

Hash TCP Options:

  • Create a list of TCP option kinds in the order they appear.
  • For example, options might be represented as [MSS, SACK Permitted, Timestamps, Window Scale] corresponding to option kinds [2, 4, 8, 3].
  • Concatenate the option kinds and compute a hash using Python:
	import hashlib
 
	options = [2, 4, 8, 3]
	options_bytes = bytes(options)
	options_hash = hashlib.sha1(options_bytes).hexdigest()[:5]
	print(options_hash)
  • Let's assume the hash computed is 7a5b6.

Hash IP Options:

  • If there are no IP options, use 000.

Assemble the Fingerprint:

  • Suppose:
    • TCP Flags: S
    • TCP Options Hash: 7a5b6
    • Window Size: 65535
    • TTL: 128
    • IP Options Hash: 000
  • The JA4T fingerprint would be: 
    fS_o7a5b6_ws65535_ttl128_ip000

Step 8: Interpret the Fingerprint

Identify the Operating System:

  • Certain TCP option patterns and window sizes are indicative of specific operating systems.
  • For example:
    • Window Size of 65535 and TTL of 128 often correspond to Windows machines.
    • Window Size of 29200 and TTL of 64 might indicate a Linux system.

Compare with Known Fingerprints:

  • Visit JA4DB to compare your fingerprint with known profiles.
  • Enter your JA4T fingerprint into the search bar to see matching client profiles.

Step 9: Document Your Findings

Create a Report:

  • Summarize the steps taken.
  • Include screenshots of Wireshark with relevant packet details.
  • Present the constructed JA4T fingerprint and its interpretation.

Reflect on the Exercise:

  • Consider how JA4T fingerprints can help in identifying client devices.
  • Think about potential applications in network security and monitoring.
JA4S IntermediateArkime Viewer