/* Aho-Corasick trie node */
#define AC_ALPHABET  256
typedef struct ac_node {
    int          children[AC_ALPHABET]; /* -1 = no child */
    int          fail;                  /* failure link */
    int          output;                /* pattern ID or -1 */
    int          output_link;           /* chain of outputs at this state */
} ac_node_t;
typedef struct {
ac_node_t nodes;
int        n_nodes;
int        n_alloc;
/ Pattern storage */
const char **patterns;
int          n_patterns;
} ac_trie_t;
/* Build phase 1: insert all patterns into the trie */
void ac_insert(ac_trie_t *ac, const char pattern, int pat_id) {
int cur = 0;  / start at root /
for (int i = 0; pattern[i]; i++) {
unsigned char c = pattern[i];
if (ac->nodes[cur].children[c] == -1) {
/ Create new node /
ac->nodes[cur].children[c] = ac->n_nodes++;
memset(&ac->nodes[ac->n_nodes-1], -1, sizeof(ac_node_t));
}
cur = ac->nodes[cur].children[c];
}
ac->nodes[cur].output = pat_id;  / mark as accepting state */
}
/* Build phase 2: compute failure links (BFS) */
void ac_build_failure(ac_trie_t ac) {
int queue[10241024], head = 0, tail = 0;
/* Root's children: fail link → root */
for (int c = 0; c < AC_ALPHABET; c++) {
    int ch = ac->nodes[0].children[c];
    if (ch != -1) {
        ac->nodes[ch].fail = 0;
        queue[tail++] = ch;
    } else {
        ac->nodes[0].children[c] = 0;  /* loop at root */
    }
}

while (head < tail) {
    int u = queue[head++];
    /* Output link: chain patterns matched at suffix of current prefix */
    int fl = ac->nodes[u].fail;
    if (ac->nodes[fl].output != -1)
        ac->nodes[u].output_link = fl;
    else
        ac->nodes[u].output_link = ac->nodes[fl].output_link;

    for (int c = 0; c < AC_ALPHABET; c++) {
        int v = ac->nodes[u].children[c];
        if (v != -1) {
            ac->nodes[v].fail = ac->nodes[ac->nodes[u].fail].children[c];
            queue[tail++] = v;
        } else {
            /* Shortcut: direct goto fail's transition */
            ac->nodes[u].children[c] = ac->nodes[ac->nodes[u].fail].children[c];
        }
    }
}
}
/* Search: feed text through automaton */
typedef void (*match_cb)(int pat_id, int offset, void *ctx);
void ac_search(ac_trie_t *ac, const uint8_t *text, size_t len,
match_cb cb, void ctx) {
int state = 0;
for (size_t i = 0; i < len; i++) {
state = ac->nodes[state].children[text[i]];
/ Report all matches ending at position i */
int s = state;
while (s != -1 && ac->nodes[s].output != -1) {
cb(ac->nodes[s].output, i, ctx);
s = ac->nodes[s].output_link;
}
}
}
/* Per-flow DPI: carry state across TCP segments /
/ The automaton state at the end of segment N is the start state for N+1 */
void dpi_process_segment(dpi_state_t *dpi, const uint8_t data, size_t len) {
/ Resume from where we left off in this flow /
ac_search_stateful(&dpi->ac_state, data, len, match_cb, dpi);
/ dpi->ac_state is preserved between calls */
}

/* JA3 — TLS ClientHello fingerprint */
/* Identifies the TLS CLIENT LIBRARY regardless of what's inside TLS */
JA3 = MD5(SSLVersion + ”,” + Ciphers + ”,” + Extensions + ”,” +
EllipticCurves + ”,” + EllipticCurvePointFormats)
Fields extracted from TLS ClientHello:
SSLVersion:              TLS record version (e.g., 771 = TLS 1.2 compat)
Ciphers:                 cipher suite IDs, hyphen-separated, sorted
Extensions:              extension type codes, hyphen-separated
EllipticCurves:          supported groups extension values
EllipticCurvePointFormats: point format extension values
/* JA3 construction example */
ClientHello has:
Version: 0x0303 (771)
Ciphers: [0x1301, 0x1302, 0x1303, 0xc02b, 0xc02c, …]
Extensions: [0, 5, 10, 11, 13, 17, 23, 35, 51, 65281, …]
Supported Groups: [0x001d, 0x0017, 0x0018, …]  (X25519, P-256, P-384)
Point Formats: [0]  (uncompressed)
JA3_string = “771,4865-4866-4867-49195-49196,…,0-5-10-11-13-17-23-35-51-65281,…,29-23-24,…,0”
JA3_hash   = MD5(JA3_string) = “bfbe6f6dba10b5d82e96766f4de6d75a”
/* Computing JA3 from libpcap capture /
#include <pcap.h>
/ Parse TLS record: type=22 (handshake), find ClientHello (type=1) /
/ Extract all fields, build string, MD5 */
/* JA3S — Server fingerprint /
JA3S = MD5(SSLVersion + ”,” + Cipher + ”,” + Extensions)
/ Identifies the TLS SERVER implementation /
/ JA3 + JA3S pair = unique fingerprint of a specific client-server pair */
/* JA4 (2023, John Althouse) — improvements over JA3 /
/ Format: TLSVersion_SNI_NumCiphers_NumExtensions_ALPN_hash(ciphers)_hash(extensions) /
/ More human-readable, more stable, better collision resistance /
JA4 = “t13d1516h2_8daaf6152771_02713d6af862”
/ t=TLS, 13=1.3, d=SNI present, 1516=1.3 first two cipher bytes, h2=ALPN */
/* JARM — Active TLS server fingerprinting /
/ Send 10 specially crafted ClientHellos to target server /
/ Hash the sequence of ServerHellos received /
/ Identifies: server TLS library, version, configuration /
/ Useful for: identifying C2 servers, distinguishing Cobalt Strike from nginx */
jarm “104.244.42.1” → “2ad2ad0002ad2ad00042d42d000000506d7c848…” → Cloudflare
jarm “52.x.x.x”     → “07d14d16d21d21d07c07d14d07d21d56c8798…” → Cobalt Strike
/* NGFW JA3 database /
known_malware_ja3 = {
“51c64c77e60f3980eea90869b68c58a8”: “Metasploit/Meterpreter”,
“e7d705a3286e19ea42f587b344ee6865”: “TrickBot trojan”,
“6734f37431670b3ab4292b8f60f29984”: “Emotet C2”,
“a0e9f5d64349fb13191bc781f81f42e1”: “Cobalt Strike default profile”,
}
/ Alert if outbound TLS has a JA3 matching a known malware fingerprint */