TCP SYN (p0f)

4:120+8:0:9002:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+:0

first seen 2026-08-28 04:32 · last seen 2026-09-14 07:59 · JSON

Decomposed attributes

IP version4
Initial TTL120+8
Options length0
MSS9002
Window sizemss*7
Window scale8
Options layoutmss,nop,ws,nop,nop,sok
Quirksdf,id+
Payload class0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t12d210700_76e208dd3e22_2dae41c691ec2
t13d1011h1_61a7ad8aa9b6_3a8073edd8ef2

HTTP request (JA4H)

fingerprintco-occurrences
ge11nr030000_476ea6bb1469_000000000000_0000000000002
ge11nr020000_e1391afd0c9d_000000000000_0000000000001
he11nr020000_e1391afd0c9d_000000000000_0000000000001

TCP SYN (JA4T)

fingerprintco-occurrences
63014_2-1-3-1-1-4_9002_84

Country

fingerprintco-occurrences
CA · Canada4

Network (ASN)

fingerprintco-occurrences
AS40934 · Fortinet Inc.4