2026-11-04 –, Ballroom Salon B Language: English
In this presentation I will explain how JA4+ network fingerprinting works, the latest updates to the fingerprint family, and show you how to easily identify devices, malware, malicious servers, inbound threats and more by passively analyzing network traffic with JA4+ and without needing to break encryption. Real-world nation-state examples and war stories included.
JA4+ is free and available across a wide range of open source and vendor tools you already use including Wireshark, Zeek, Arkime, Suricata, nginx, F5, Censys, Vectra, etc.
John Althouse was previously at Salesforce for 10 years as the Director of Threat Detection. While there, John and his team created notable network fingerprinting methods such as JA3/S, JARM, and HASSH, used throughout the industry. He is now working full-time on JA4+ network fingerprinting to solve as many cybersecurity challenges as possible.