https://github.com/refraction-networking/tls-fingerprint
https://github.com/refraction-networking/tls-fingerprint
Last synced: about 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/refraction-networking/tls-fingerprint
- Owner: refraction-networking
- License: apache-2.0
- Created: 2022-11-01T00:15:19.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2024-06-10T17:16:30.000Z (about 2 years ago)
- Last Synced: 2025-03-03T10:22:06.301Z (over 1 year ago)
- Language: TeX
- Size: 10.4 MB
- Stars: 22
- Watchers: 2
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# tls-fingerprint
This tool observes TLS Client Hello messages, and creates unique fingerprints to track the frequency and distribution of messages seen. When run on a sufficient traffic source, this tool allows researchers to learn which client hello messages are most popular.
Knowing statistics of common ClientHello messages can help inform design decisions in relevant software, such as webservers. In addition, this also enables censorship circumvention tools to be able to keep track of which TLS client implementations should be mimicked, and if their tool has a unique fingerprint
## Installing
```
git clone --recurse-submodules https://github.com/sergeyfrolov/tls-fingerprint/
cd tls-fingerprint/PF_RING
make
cd ../
make
```
## Running
### Lite version
* Writes to stdout.
* Does not require PF_RING.
* Useful to get fingerprint ID of your application to compare it against our db later.
Simply run `./rust-src/target/release/tls_fingerprint $INTERFACE`
### PF_RING version
* Writes to PostgreSQL.
* Requires PF_RING.
* Used to collect a database of fingerprint on a high-bandwidth taps. Was tested on 10Gbps links.
You'll need to run `zbalance_ipc` from PF\_RING on the interface you want to capture. (See
PF\_RING for how to configure and set up using zero-copy PF\_RING and zbalance clusters)
Then, you can run `./tls-fingerprint -c $CLUSTER_NUM -n $CORES` for the cluster number and
number of cores to run on (parameters also passed to `zbalance_ipc`