Summary
Implement a TLS analyzer that parses ClientHello messages to extract SNI, cipher suites, and JA3 fingerprints.
Requirements
- Detect TLS handshake (content type 0x16, handshake type 0x01) in TCP payload on port 443
- Extract Server Name Indication (SNI) from extensions
- Extract offered cipher suites and TLS version
- Compute JA3 fingerprint hash for client profiling
- Flag suspicious patterns: self-signed indicators, unusual cipher suites, GREASE values
Acceptance Criteria
Summary
Implement a TLS analyzer that parses ClientHello messages to extract SNI, cipher suites, and JA3 fingerprints.
Requirements
Acceptance Criteria
TlsAnalyzerimplementsProtocolAnalyzer