Fixed JA4 version fallback value

gchq · Aug 14, 2024 · 7a5225c · 7a5225c
1 parent a477f47
commit 7a5225c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/core/lib/JA4.mjs b/src/core/lib/JA4.mjs
@@ -44,7 +44,7 @@ export function toJA4(bytes) {
         the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
         should be ignored.
     */
-    let version = tlsr.version.value;
+    let version = tlsr.handshake.value.helloVersion.value;
     for (const ext of tlsr.handshake.value.extensions.value) {
         if (ext.type.value === "supported_versions") {
             version = parseHighestSupportedVersion(ext.value.data);
@@ -189,7 +189,7 @@ export function toJA4S(bytes) {
         the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
         should be ignored.
     */
-    let version = tlsr.version.value;
+    let version = tlsr.handshake.value.helloVersion.value;
     for (const ext of tlsr.handshake.value.extensions.value) {
         if (ext.type.value === "supported_versions") {
             version = parseHighestSupportedVersion(ext.value.data);