JA4
JA4L Fingerprinting

JA4Latency (JA4L) Fingerprinting Guide

JA4L is an innovative technique designed to measure client latency by analyzing the timing of the initial packets in a network connection. This method is particularly useful for determining the physical distance between a client (or VPN exit node) and a server, which can reveal insights into network performance and potential security issues. The concept extends to JA4LS, which focuses on server-side latency.

License: This technology is currently experimental, patent pending, and licensed under the FoxIO License 1.1.

Key Concepts

  • JA4L (Client Latency): Measures the latency from the server’s perspective.
  • JA4LS (Server Latency): Measures the latency from the client’s perspective.
  • Latency Measurement Unit: Time is measured in microseconds (µs), with 1 millisecond (ms) equaling 1,000 µs.

How It Works

JA4L focuses on the timing of the first few packets in a connection. By capturing timestamps of these packets, we can estimate the physical distance between endpoints. This technique can be applied in various contexts:

  • Server-Side Monitoring: Measures client distance from the server.
  • Client-Side Monitoring: Measures server distance from the client.
  • Network Tap Scenario: Measures distance from the tap to both client and server.

JA4L Breakdown

  • Part a: Latency within the TCP handshake.
  • Part b: Observed Time To Live (TTL) values.
  • Part c: Latency during application-level protocol negotiation.

TCP Handshake Example

For a TCP connection, the three-way handshake process involves capturing multiple timestamps:

  • Client SYN Packet: Timestamp as A and initial TTL value.
  • Server SYN-ACK Packet: Timestamp as B and server TTL.
  • Client ACK Packet: Timestamp as C.
  • Client First Application Packet (e.g., TLS Client Hello): Timestamp as D.
  • Server Application Response (e.g., TLS Server Hello): Timestamp as E.
  • Client Response: Timestamp as F.

Captured Timestamps Example

A = 48925683 µs
B = 48925710 µs
C = 48936092 µs
D = 48936092 µs
E = 48937665 µs
F = 49027693 µs

JA4L Calculations

JA4L = {(C - B) / 2}_{Client TTL}_{(F - E) / 2}
JA4L = (5191 µs)_{42}_(45014 µs)

JA4LS Calculations

JA4LS = {(B - A) / 2}_{Server TTL}_{(E - D) / 2}
JA4LS = (13.5 µs)_{64}_(786.5 µs)

Calculating Distance

Using the formula for distance:

D = (j * c) / p

Where:

  • D: Distance in miles or kilometers.
  • j: Measured latency in µs.
  • c: Speed of light per µs in fiber (~0.128 miles or ~0.206 km per µs).
  • p: Propagation delay factor based on terrain and network conditions.

Propagation Delay Factor Table

| Hop Count | Propagation Delay Factor (p) |
|-----------|------------------------------|
| <=21      | 1.5                          |
| 22        | 1.6                          |
| 23        | 1.7                          |
| 24        | 1.8                          |
| 25        | 1.9                          |
| >=26      | 2.0                          |

Example Calculation

  • JA4L a: 5191 µs
  • Client TTL: 42 (Initial TTL likely 64)
  • Hop Count: 64 - 42 = 22
  • Propagation Delay Factor (p): 1.6

Distance to VPN Exit Node:

D = (5191 µs * 0.128 miles/µs) / 1.6 ≈ 415 miles

Delta between parts a and c:

  • Delta: 45014 µs - 5191 µs = 39823 µs

Distance from Client to VPN Exit Node:

D = (39823 µs * 0.128 miles/µs) / 1.6 ≈ 3,185 miles

QUIC Protocol Example

For QUIC (HTTP/3 over UDP), the latency measurement involves capturing the following timestamps:

  • Client Initial QUIC Packet: Timestamp as A.
  • Server Initial QUIC Packet: Timestamp as B.
  • Server Handshake Packets: Timestamp of the last packet before client response as C.
  • Client Second Packet: Timestamp as D.

JA4L and JA4LS Calculations

JA4L = {(D - C) / 2}_{Client TTL}_q
JA4LS = {(B - A) / 2}_{Server TTL}_q

Example Values

A = 2337542 µs
B = 2406772 µs
C = 2485706 µs
D = 2515261 µs

Calculations

JA4L = (14777 µs)_{128}_q
JA4LS = (34615 µs)_{38}_q

Conclusion

JA4L and JA4LS provide a powerful framework for measuring latency and distance in network connections. By applying these methods, security professionals can enhance their understanding of network behavior and detect anomalies that may indicate security threats.

Disclaimer: The methods described here are intended for educational purposes. Ensure compliance with legal and ethical standards when conducting network traffic analysis.

JA4T FingerprintingJA4LS Fingerprinting