From 4e73bdca56eb258d3c2c70505bfb28d33d25b19e Mon Sep 17 00:00:00 2001
From: Joge <87136119+jogecodes@users.noreply.github.com>
Date: Wed, 5 Jun 2024 15:23:19 +0200
Subject: [PATCH] Update ja4.py

Added protection against bugs in IPv6 signature extraction (to be fixed in future versions of the plugin)
---
 nfstream/plugins/ja4.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nfstream/plugins/ja4.py b/nfstream/plugins/ja4.py
index ab597b2..8d1a229 100644
--- a/nfstream/plugins/ja4.py
+++ b/nfstream/plugins/ja4.py
@@ -16,6 +16,10 @@ def get_protocol(packet):
         protocol (str): detected protocol, "t" for TCP, "q" for QUIC
         payload (scapy.layers.inet.TCP or scapy.layers.inet.UDP): payload of the packet (at transport layer level)
     """
+    # If the packet is not IPv4, None is returned
+    # (only IPv4 packets are considered for JA4 fingerprint extraction)
+    if packet.ip_version != 4:
+        return None, None
     # TCP detection and TCP payload extraction
     ip_packet = IP(packet.ip_packet)
     if ip_packet.p == IP_PROTO_TCP: