ja3s python program not working

[sajualways]

python3 ja3s.py -j trace1.pcap
[]

[aygupt1822]

Can you send me your pcap file ?

[abbbe]

@aygupt1822, I came across the same issue, for me it boiled down to different pcap format used when tcpdump is launched with 'any' interface specification. In my case (some Debian-based nginx docker container) it produced so called "Linux cooked v2" pcap format which ja3 fails to support. Linktype value is 276, corresponds to https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html linktype.

[aygupt1822]

I was also having the exact issue that @sajualways described while generating JA3 and JA3s on the my Ubuntu machine.

I solved this problem by adding the Ja3 lua plugin in wireshark.
So when the pcap loads in Wireshark you can then add the Ja3 and Ja3s as "Columns" filters in wireshark, filter the TLS packets and then export the details in CSV format.