Connections cut by their TLS fingerprint (JA4), measured, 2026-10-19¶
XGS: Settings - Cut connections by TLS fingerprint. JA4 is a fingerprint of a TLS ClientHello -
the version, ciphers, extensions and protocols a client offers - so it names the software that opened
a connection rather than the address it went to. OPNsense's Intrusion Detection (Suricata 8) writes
one for every TLS connection it sees once its TLS log carries the JA4 field. With fingerprints listed
here, scripts/xgs/ja4_cut.py reads that log every two seconds (started each minute by cron) and
when the settings are saved, and kills by id every pf state of a connection it shows with a listed
fingerprint; the driver then takes the connection out of hardware, as it does for a block list
(lists-cut-2026-10-19.md).
The whole page, with how it was taken and what it does not show: Connections cut by their TLS fingerprint (JA4), measured, 2026-10-19.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.