JA4_c hashes an empty field to e3b0c44298fc when it should be 000000000000
Summary
All JA4+ fingerprints should output their sections as 12 zeros 000000000000
when there is nothing to hash, rather than performing a hash of nothing e3b0c44298fc
This makes it clear to the user when a field has no values, which would be very odd in the case of TLS
To be clear, this is an extreme edge case.
Steps to reproduce
Attached is a pcap example.
What is the current bug behavior?
The JA4_c section is e3b0c44298fc
What is the expected correct behavior?
It should be 000000000000
Sample capture file
Build information
Wireshark v4.4.0