TCP SYN (p0f)

4:114+14:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0

first seen 2026-07-01 00:59 · last seen 2026-10-26 20:09 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog →

powershell 7.6.7 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:09 controlled
powershell 5.1.26100.33648 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:09 controlled
firefox 157.0.1 · Windows 10.0.26100.33438 · via geckodriver · ci — 1 session, last 2026-10-19 20:09 controlled
edge 154.0.4258.62 · Windows 10.0.26100.33438 · ci — 1 session, last 2026-10-19 20:08 controlled
chrome 155.0.8059.40 · Windows 10.0.26100.33438 · ci — 1 session, last 2026-10-19 20:08 controlled
powershell 7.6.5 · Windows 10.0.26100.33296 · ci — 3 sessions, last 2026-08-26 06:55 controlled
powershell 5.1.26100.33296 · Windows 10.0.26100.33296 · ci — 2 sessions, last 2026-08-26 06:55 controlled
firefox 154.0 · Windows 10.0.26100.33296 · via geckodriver · ci — 2 sessions, last 2026-08-26 06:54 controlled
edge 151.0.4129.93 · Windows 10.0.26100.33296 · ci — 3 sessions, last 2026-08-26 06:54 controlled
chrome 151.0.7922.170 · Windows 10.0.26100.33296 · ci — 3 sessions, last 2026-08-26 06:54 controlled

TCP SYN signatures from container or CI runners reflect the capture environment's kernel and network path, not the named client — the layers above (TLS, HTTP/2, HTTP) are the client's own.

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

IP version	`4`
Initial TTL	`114+14`
Options length	`0`
MSS	`1440`
Window size	`65535`
Window scale	`8`
Options layout	`mss,nop,ws,nop,nop,sok`
Quirks	`df,id+,ecn`
Payload class	`0`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d2013h2_2b729b4bf6f3_e24568c0d440` Match?Exact match in Thumbprint's published controlled catalog captures: winhttp 10.0.20348.1.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d2212h2_231e334592e8_36bf25f296df` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.	2
`t13d1013h2_01be160bb49b_e24568c0d440`	2
`t13d1012h2_01be160bb49b_36bf25f296df`	2
`t13d2012h2_2b729b4bf6f3_36bf25f296df`	2
`t13d1011h2_61a7ad8aa9b6_3a8073edd8ef`	1
`t13d2013h1_2b729b4bf6f3_e24568c0d440`	1
`t13d1013h1_01be160bb49b_e24568c0d440` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.16.0, curl 8.21.0, curl 8.13.0.The fingerprint page shows the full measured match list. More on the catalog.	1
`t13d2213h1_231e334592e8_e24568c0d440`	1
`t13d2213h2_231e334592e8_e24568c0d440`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn000000_000000000000_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: rust-hyper 1.11.1, rust-hyper 1.11.0, rust-hyper 1.12.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	6
`ge20nn020000_fb4f949fd323_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.	3
`ge11nn030000_fe444ad14866_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.16.0, curl 7.88.1, curl 8.21.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.	3
`ge20nn010000_a510e5066512_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: java-httpclient 17.0.19, java-httpclient 11.0.31, winhttp 10.0.20348.1, +9 more.The fingerprint page shows the full measured match list. More on the catalog.	2
`ge20nr020000_e5a56608905c_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`2:0;4:65535\|67043329\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.	9
`2:0;4:10485760\|33488897\|0\|m,p,a,s`	2
`2:0;4:2097152;5:16384;6:16384\|5177345\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.13.5, rust-reqwest 0.13.4, +4 more.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (JA4T)

fingerprint	co-occurrences
`65535_2-1-3-1-1-4_1440_8`	15

User-Agent

fingerprint	co-occurrences
`curl/8.16.0`	3
`Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.26100; en-US) PowerShell/7.6.6`	3
`schannel-defaults-experiment`	2
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36`	1

Country

fingerprint	co-occurrences
`US` · United States	15

Network (ASN)

fingerprint	co-occurrences
`AS8075` · Microsoft Corporation	15

fingerprint	co-occurrences
`2:0;4:65535\|67043329\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.	9
`2:0;4:10485760\|33488897\|0\|m,p,a,s`	2
`2:0;4:2097152;5:16384;6:16384\|5177345\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.13.5, rust-reqwest 0.13.4, +4 more.The fingerprint page shows the full measured match list. More on the catalog.	1