Raw ClientHello capture with exact extension order | 2025-12-08 14:20:45
This is the EXACT order from the raw ClientHello bytes
| # | Name | Hex | Decimal |
|---|---|---|---|
| 0 | TLS_AES_256_GCM_SHA384 | 0x1302 | 4866 |
| 1 | TLS_AES_128_GCM_SHA256 | 0x1301 | 4865 |
| 2 | TLS_CHACHA20_POLY1305_SHA256 | 0x1303 | 4867 |
| 3 | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | 0xC02C | 49196 |
| 4 | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | 0xC02B | 49195 |
| 5 | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 | 0xCCA9 | 52393 |
| 6 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | 0xC030 | 49200 |
| 7 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | 0xC02F | 49199 |
| 8 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 | 0xCCA8 | 52392 |
| 9 | 0x00FF | 0x00FF | 255 |
{
"http2": {
"akamai_fingerprint": "1:65536;2:0;4:6291456;6:262144|15663105|0|m,a,s,p",
"akamai_fingerprint_hash": "52d84b11737d980aef856699f885ca86",
"settings": {
"1": 65536,
"2": 0,
"4": 6291456,
"6": 262144
},
"window_update": 15663105
},
"http_version": "HTTP/2.0",
"remote_addr": "216.73.216.19:28683",
"timestamp": "2025-12-08T14:20:45.636595162Z",
"tls": {
"alpn": [
"h2",
"http/1.1"
],
"cipher_suites": [
4866,
4865,
4867,
49196,
49195,
52393,
49200,
49199,
52392,
255
],
"extensions": [
11,
45,
35,
13,
23,
5,
16,
10,
0,
43,
51
],
"ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-35-13-23-5-16-10-0-43-51,29-23-24,0",
"ja3_hash": "81d6cc43e7dc63f8a8574c0008a0c9e5",
"ja4": "t13d1011h2_61a7ad8aa9b6_861bc38b0be4",
"ja4_r": "t13d1011h2_00ff,1301,1302,1303,c02b,c02c,c02f,c030,cca8,cca9_0000,0005,000a,000b,000d,0010,0017,0023,002b,002d,0033_0503,0403,0807,0806,0805,0804,0601,0501,0401",
"server_name": "fp.unapausa.com",
"signature_algs": [
1283,
1027,
2055,
2054,
2053,
2052,
1537,
1281,
1025
],
"supported_groups": [
29,
23,
24
]
},
"user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
}