Module ja4l 

Available on crate feature ja4plus only.

JA4L / JA4LS latency fingerprint (“light distance”) — FoxIO.

Estimates the one-way latency between two hosts from the handshake timing, pairing it with the observed TTL/hop-limit so an analyst can reason about physical distance and detect proxies/VPNs (a TTL that disagrees with the latency).

Format (FoxIO): {latency_microseconds}_{ttl}

• latency_microseconds — half the round-trip between the two timed packets, i.e. (t_later − t_earlier) / 2, truncated to whole µs.
• ttl — the IPv4 TTL / IPv6 hop-limit observed on the measuring side.

The two standard measurements:

• JA4L-C (client): (ACK − SYN-ACK) / 2, with the client’s TTL.
• JA4L-S (server): (SYN-ACK − SYN) / 2, with the server’s TTL.

The optional third field FoxIO appends from the TLS ClientHello/ServerHello timing is out of scope here (it needs handshake-timestamp plumbing); flowscope produces the two-field core, which is what the TTL/distance analysis uses. Reference: FoxIO zeek/ja4l/main.zeek.

Issue #77.

Functions

half_latency_micros

One-way latency in microseconds = (later − earlier) / 2, truncated. Returns None if later < earlier (out-of-order capture — the FoxIO reference rejects negative durations rather than guessing).

ja4l

Format a JA4L string from an already-computed one-way latency (µs) and TTL.

ja4l_client

JA4L-C (client light distance): (ACK − SYN-ACK) / 2 with the client TTL. Pass the SYN-ACK and the client’s ACK timestamps.

ja4l_from_timestamps

JA4L from two packet timestamps + the measuring side’s TTL. None on an out-of-order (negative-duration) pair.

ja4l_server

JA4L-S (server light distance): (SYN-ACK − SYN) / 2 with the server TTL. Pass the SYN and the SYN-ACK timestamps.