Trisul Network Analytics
Developer Zone

**This is an old revision of the document!** ----

====== Automatically resolving unknown TLS Fingerprints ====== TLS Fingerprinting is still in its early days therefore the coverage of known prints is not too deep. The Trisul [[app:tlsfingerprint|TLS Fingerprint App]] ships with a known fingerprint database of about 500 entries ([[https://github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json|ja3prints.json]]) but you will likely find anywhere from 50-70% unknown fingerprints. We need a way to resolve prints to client ID. Internally we use a Ruby TRP script that can automate this process. The script is available at [[https://github.com/trisulnsm/trisul-scripts/tree/master/lua/frontend_scripts/reassembly/ja3/prints|mk_ja3print.rb]] ===== How this works =====