How Does JA4/JA4H Analyze Client Architecture for WAF Detection?

By U Debasish RaoUpdated 5 Apr 20262 min read

How Does JA4/JA4H Analyze Client Architecture for WAF Detection?
On this page
  1. 🔍 What Are JA4 and JA4H?
  2. 🔐 How JA4 Works (TLS Fingerprinting)
  3. 🧪 Example JA4 Fingerprint:
  4. 🌐 How JA4H Works (HTTP Fingerprinting)
  5. 🧪 Example JA4H Fingerprint:
  6. 🛠️ Combining JA4 + JA4H: Detecting Client Stack & Architecture
  7. 👇 Example Scenarios:
  8. 🔒 Security Use Cases for WAF & SOC
  9. ✅ Threat Hunting
  10. ✅ SOC Investigation
  11. ✅ WAF Rules
  12. ⚙️ Tools to Use
  13. 🧩 Fingerprint Inference Cheat Sheet
  14. 📌 Why It Matters
  15. 🔚 Final Thoughts

Client Architecture in JA4/JA4H WAF Detection plays a crucial role in understanding the true nature of the device connecting to your web applications. JA4 and JA4H leverage TLS fingerprinting to map and monitor client characteristics, helping Web Application Firewalls (WAFs) distinguish between legitimate and suspicious traffic. This blog explores how these signatures decode client architecture and help detect malicious activity.

🔍 What Are JA4 and JA4H?

StandardProtocol LayerPurposeJA4TLS (Transport Layer Security)Fingerprint based on TLS ClientHello dataJA4HHTTPFingerprint based on HTTP request metadata

Together, they give a stack-aware view of a client, enabling analysts to spot inconsistencies between expected and actual behavior.

🔐 How JA4 Works (TLS Fingerprinting)

JA4 captures elements of the TLS ClientHello message during a handshake:

  • Cipher suite list and order
  • TLS extensions
  • Elliptic curve preferences
  • ALPN (Application-Layer Protocol Negotiation)
  • TLS version

🧪 Example JA4 Fingerprint:

0a15_E.1F.1D.1A.0.1

This unique code reflects the TLS handshake behavior of the client. By comparing it to known patterns, you can determine:

  • Browser (e.g., Chrome, Firefox)
  • Operating system (e.g., Linux, Windows)
  • TLS library (e.g., OpenSSL, BoringSSL, NSS)

🌐 How JA4H Works (HTTP Fingerprinting)

JA4H evaluates HTTP metadata and structure:

  • HTTP method (GET, POST, etc.)
  • Protocol version (HTTP/1.1, HTTP/2)
  • Header count and order
  • Cookie presence
  • Hashes of headers

🧪 Example JA4H Fingerprint:

0a15_E.1F.1D.1A.0.1

It helps distinguish between:

BehaviorLikely SourceRealistic headers + UABrowser on Windows/macOSMinimal headers, no UAScripted bot or malware clientInconsistent orderingMalformed client or spoofed bot

🛠️ Combining JA4 + JA4H: Detecting Client Stack & Architecture

When combined, JA4 and JA4H offer deep insights into:

  • Client architecture (x86_64 vs ARM)
  • TLS/HTTP stack (Python bot, browser, curl, malware)
  • Headless tools (Selenium, Puppeteer)
  • Obfuscation or spoofing attempts

👇 Example Scenarios:

TLS FingerprintHTTP FingerprintWhat It SuggestsChrome TLSCurl HTTPMismatched stack → likely spoofed trafficLegacy TLSAndroid UAMobile malware or outdated appBoringSSLReal HTTP headersReal Chrome browser on desktopOpenSSLNo cookiesCLI tools, curl bots, malware

🔒 Security Use Cases for WAF & SOC

✅ Threat Hunting

  • Detect imposter clients (wrong UA but different JA4/JA4H)
  • Spot mass botnets with repeated JA4 patterns

✅ SOC Investigation

  • Correlate logs using $ja4 and $ja4h in SIEM systems
  • Identify suspicious JA4H patterns (e.g., short header lists)

✅ WAF Rules

  • Block clients with obsolete JA4 (e.g., TLS 1.0 fingerprints)
  • Monitor new JA4s that don’t match known clients

⚙️ Tools to Use

  • JA4-NGINX Module: Injects JA4/JA4H into logs

👉 GitHub

  • Suricata JA4 Rules (in progress): For inline detection
  • Wireshark & Zeek: Can extract TLS fingerprint traits
  • Threat Intelligence Feeds: Map known malware JA4s

🧩 Fingerprint Inference Cheat Sheet

Signature TraitYou Can Infer...JA4 cipher preferenceTLS library, browser familyJA4 extension orderOS quirks or outdated clientJA4H header countHuman vs botCookie headers in JA4HLegitimate browser or appALPN + curvesHTTP2 support, TLS client capability

📌 Why It Matters

  • Traditional user-agent headers are easy to spoof.
  • IPs change, VPNs rotate — but JA4+JA4H is hard to fake.
  • This fingerprinting is lightweight but highly effective for SOCs, WAFs, and DFIR teams.

🔚 Final Thoughts

Fingerprinting using JA4 and JA4H is a powerful weapon in the hands of defenders. It gives us visibility into the real client stack, enabling smarter, faster, and deeper detection.

As client stacks evolve, defenders must evolve too — and fingerprinting is how we stay ahead of the threats.