Catalog session #638

curl 8.18.0 on Fedora 44 — identity declared before the run, captured through the live edge.

Verificationcontrolled
Runnercontainer
Registered2026-09-01 00:41
Captured2026-09-01 00:41
Drivercapture-matrix/d04b10e
Runmonthly-2026-09-01-104054
Modeprod
Imagefpcap-curl-http3
Image digestsha256:83fbbcfa8b9b31875263f6096e25ed425bb4b3f7a0cda1b23e0c98851b6af165
Matrix SHA-256c6498282f322
Raw client versioncurl 8.18.0 (x86_64-redhat-linux-gnu) libcurl/8.18.0 OpenSSL/3.5.7 zlib/1.3.1.zlib-ng brotli/1.2.0 libidn2/2.3.8 libpsl/0.21.5 libssh/0.12.2/openssl/zlib nghttp2/1.68.0 ngtcp2/1.22.1 nghttp3/1.18.0 mit-krb5/1.22.2 OpenLDAP/2.6.13
FeaturesFeatures: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets

Captures (2)

The first capture is the registration page view; probe captures are the beacon hitting each configured origin with this session's correlation id — for browsers that is how one session records both the TCP and QUIC stacks.

2026-09-01 00:41 · page · tcp (HTTP/2) · thumbprint.me

TLS ClientHello (JA4) t13d3513h2_bfa337485184_8d7351bd871b
HTTP request (JA4H) ge20nn020000_5594a17e7e7e_000000000000_000000000000
HTTP/2 frames (Akamai) 3:100;4:65536;2:0|1048510465|0|m,s,a,p
TCP SYN (p0f) 4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0
TCP SYN (JA4T) 64240_2-4-8-1-3_1460_10
User-Agent curl/8.18.0
verbatim wire tuple (immutable evidence, includes raw variants)
{
  "akamai_h2": "3:100;4:65536;2:0|1048510465|0|m,s,a,p",
  "alpn": "h2",
  "ja4": "t13d3513h2_bfa337485184_8d7351bd871b",
  "ja4_o": "t13d3513h2_f8a84e837758_5cc6710dfadd",
  "ja4_r": "t13d3513h2_002f,0033,0035,0039,003c,003d,0067,006b,009c,009d,009e,009f,1301,1302,1303,1304,c009,c00a,c013,c014,c023,c027,c02b,c02c,c02f,c030,c09c,c09d,c09e,c09f,c0ac,c0ad,cca8,cca9,ccaa_000a,000b,000d,0016,0017,001b,002b,002d,0031,0033,ff01_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301",
  "ja4_ro": "t13d3513h2_1302,1303,1301,1304,c02c,c030,cca9,cca8,c0ad,c02b,c02f,c0ac,c023,c027,c00a,c014,c009,c013,009d,c09d,009c,c09c,003d,003c,0035,002f,009f,ccaa,c09f,009e,c09e,006b,0067,0039,0033_ff01,0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,001b_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601,0303,0301",
  "ja4h": "ge20nn020000_5594a17e7e7e_000000000000_000000000000",
  "ja4h_r": "ge20nn020000_user-agent,accept__",
  "tcp_ja4t": "64240_2-4-8-1-3_1460_10",
  "tcp_p0f": "4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0",
  "tls_cipher": "TLS_AES_256_GCM_SHA384",
  "tls_version": "TLSv1.3",
  "user_agent": "curl/8.18.0"
}

2026-09-01 00:41 · probe · quic (HTTP/3) · thumbprint.me

TLS ClientHello (JA4) q13d0413h3_9caa18292e23_23fce1e67d98
HTTP request (JA4H) ge30nn020000_5594a17e7e7e_000000000000_000000000000
QUIC transport params q08_bae576bf37b0
User-Agent curl/8.18.0
verbatim wire tuple (immutable evidence, includes raw variants)
{
  "alpn": "h3",
  "ja4": "q13d0413h3_9caa18292e23_23fce1e67d98",
  "ja4_o": "q13d0413h3_fce5854592ef_f74cb1636568",
  "ja4_r": "q13d0413h3_1301,1302,1303,1304_000a,000b,000d,0016,0017,001b,002b,002d,0031,0033,0039_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601",
  "ja4_ro": "q13d0413h3_1302,1303,1301,1304_0039,0000,000b,000a,0010,0016,0017,0031,000d,002b,002d,0033,001b_0904,0905,0906,0403,0503,0603,0807,0808,0809,080a,080b,0804,0805,0806,0401,0501,0601",
  "ja4h": "ge30nn020000_5594a17e7e7e_000000000000_000000000000",
  "ja4h_r": "ge30nn020000_user-agent,accept__",
  "quic_tp": "q08_bae576bf37b0",
  "quic_tp_r": "q08_0004,0005,0006,0007,0008,0009,000f,0011",
  "tls_cipher": "TLS_AES_256_GCM_SHA384",
  "tls_version": "TLSv1.3",
  "user_agent": "curl/8.18.0"
}

← catalog