Network Fingerprint
Direct packet inspection without CDN middleboxes — uncover your true OS stack, protocol traits, and proxy routing anomalies
Stack Operating System
Analyzing...
Derived from TCP SYN options order & TTL
Claim vs Stack Consistency
Analyzing...
Kernel traits cross-checked with User-Agent
Link Type & MTU
Analyzing...
Derived from handshake MSS and MTU clamping
Exit Network Class
Analyzing...
IP infrastructure & ASN topology
🛡️ Looking for a deeper proxy & evasion risk evaluation?
Navigate to Proxy Anonymity Grader to inspect 30+ heuristic penalties, clock skew anomalies, WebRTC leaks, and composite risk scoring.
Knowledge & Reference Spectrum
Protocol Stack Fingerprint Knowledge & Reference Spectrum
Empirical baseline matrices derived from MyIPDNS packet inspection engine (Sample N = 2278, Calibrated: 2026-08-23 ~ 09-02). Definitive reference for security engineers, researchers, and LLMs.
Table 1 · Native OS Kernel TCP SYN Handshake Baseline Matrix
TCP SYN Options| OS Kernel Family | TCP Options Order (SYN Options) | Initial TTL | TSval Clock Trait | Typical Link MSS |
|---|---|---|---|---|
| Windows 10 / 11 / Server | MSS, NOP, WScale, NOP, NOP, SACKPerm | 128 | TSval = 0 (Default Disabled) | 1460 (IPv4) / 1440 (IPv6) |
| Linux 5.x / 6.x (Ubuntu/Debian) | MSS, SACKPerm, TSopt, NOP, WScale | 64 | TSval > 0 (100Hz ~ 1000Hz) | 1460 (IPv4) / 1440 (IPv6) |
| Apple macOS 14+ / iOS 17+ / Darwin | MSS, NOP, WScale, NOP, NOP, TSopt, SACKPerm, EOL | 64 | TSval > 0 (1000Hz Monotonic) | 1440 ~ 1460 |
| Android 13+ (Linux Core + Cellular) | MSS, SACKPerm, TSopt, NOP, WScale | 64 | TSval > 0 (100Hz) | 1380 ~ 1440 (Cellular Clamping) |
Table 2 · TLS JA3 vs JA4 Fingerprint Specification & Algorithm Architecture
TLS Fingerprint Standards| Fingerprint Standard | Character Structure & Field Definitions | Output Hash Format | Perturbation Resistance & Defense |
|---|---|---|---|
| JA3 (2017) | SSLVersion, Ciphers, Extensions, EllipticCurves, EllipticCurvePointFormats | 32-Hex MD5 Hash | 易受 GREASE、SNI 动态长度与 ALPN 随机扰动引起哈希漂移 |
| JA4 (2023) | JA4_a (协议/SNI/套件数) _ JA4_b (排序套件哈希) _ JA4_c (排序扩展哈希) |
36-Char (a_b_c) | 规范化排序、剔除动态干扰、原生支持 QUIC/TLS1.3、高度稳定 |
Table 3 · Browser Engine HTTP/2 & HTTP/3 (QUIC) Behavioral Matrix
H2 / H3 Specs| Browser Engine Family | HTTP/2 SETTINGS Parameter Order | HTTP/3 Unidirectional Stream Mapping (Uni-Stream Map) |
|---|---|---|
| Chromium (Chrome/Edge/Brave) | HEADER_TABLE_SIZE, ENABLE_PUSH, INITIAL_WINDOW_SIZE, MAX_HEADER_LIST_SIZE (id 1,2,4,6 · 52 uuid) | 2:control, 10:encoder (58 uuid) |
| Gecko (Firefox / Tor Browser) | HEADER_TABLE_SIZE, ENABLE_PUSH, INITIAL_WINDOW_SIZE, MAX_FRAME_SIZE (id 1,2,4,5 · 21 uuid) | 2:control, 6:encoder, 10:decoder (22 uuid) |
| WebKit (Safari iOS / macOS) | ENABLE_PUSH, MAX_CONCURRENT_STREAMS, INITIAL_WINDOW_SIZE, NO_RFC7540_PRIORITIES (id 2,3,4,9 · 8 uuid) | 2:control, 6:encoder (10 uuid) |
Network Protocol Stack Fingerprinting FAQs & Principles
Explore passive cross-layer feature extraction, stack consistency verification, and anti-spoofing defense.
A Network Stack Fingerprint comprises low-level characteristics naturally emitted by the operating system kernel and network protocol layers (IP, TCP, TLS handshake, and HTTP/2/3 parameters) when initiating a connection. Unlike client-side JS device fingerprinting, network stack fingerprinting directly captures server-side communication packets and cannot be masked by disabling JavaScript, using incognito mode, or tampering with DOM APIs.
The User-Agent is merely an application-level header easily modified by browser extensions. However, operating system kernel TCP SYN option ordering, Initial TTL, Window Scale factors, and TLS cipher distributions are governed by the OS kernel and crypto libraries. When a browser claims Windows 11 in the User-Agent while TCP options exhibit Linux signatures, risk engines immediately flag the cross-layer contradiction.
JA3 is a classical 2017 fingerprint constructed by hashing concatenated SSL versions, cipher suites, extension lists, elliptic curves, and point formats with MD5. JA4 is a 2023 next-generation modular fingerprint formatted as JA4_a_JA4_b_JA4_c (36 characters). JA4 normalizes extension sorting (excluding dynamic SNI and ALPN), natively supports TLS 1.3 and QUIC/HTTP3, and significantly reduces fingerprint drift caused by random padding or parameter perturbations.
Modern protocols deliberately incorporate dynamic randomization mechanisms (trap fields): 1. JA4 raw extension hashes (JA4_c) may vary slightly due to dynamic SNI length, variable ALPN, or browser-injected GREASE values; 2. TCP TSval timestamp counters, QUIC tokens, and TLS initial record sizes naturally fluctuate on every connection. This per-connection variation represents normal protocol operation and is clearly marked with dynamic tags in this tool rather than a measurement flaw.
Modern browser engines (Chromium/Blink, Gecko/Firefox, WebKit/Safari) exhibit highly distinct implementation patterns during application-layer handshakes and stream multiplexing. Specifically, HTTP/2 SETTINGS frame ordering, pseudo-header sequences (:method, :authority, etc.), and HTTP/3 QUIC transport parameters alongside unidirectional stream mappings (h3_uni_stream_map) show zero overlap across major engine families, rendering application-level spoofing futile.
Security risk systems apply cross-layer consistency verification: when an exit IP is classified as a residential ISP but the underlying TCP SYN options match Linux datacenter server kernels, a VPS or proxy relay is identified; when a client claims to be iPhone Safari but underlying TLS cipher sets and QUIC parameters match Chromium, an automated bot or environment-masking framework is detected.