Name: Interactive Networking Fingerprinting Walkthrough
Start: 2025-11-14T09:00:00.000-05:00
End: 2025-11-14T12:00:00.000-05:00
Location: Florida SouthWestern State College

BSides SWFL

All registrations are final and no refunds will be issued.

In the unlikely event of cancellation of a portion of, or the entirety of, BSides SWFL 2025, BSides SWFL (in its sole discretion) may issue a partial/full refund. All refunds will be for the registration price, and may not include any service fees, credit card processing fees, and other such charges. 

If the conference is rescheduled to other dates, your registration(s) will be valid for the new conference dates. 

If a registrant is unable to attend the BSides SWFL 2025 event for any reason they may substitute, by arrangement with the registrar, someone else to attend in their place.

All refunds will be issued directly to the original payment method.

For questions, please email contact@bsidesswfl.org

As scanning and reconnaissance grow ever more diverse - from public platforms like Shodan and Censys to stealthy probing by botnets and bulletproof hosting - security teams need better ways to profile who’s on the other side of their network connections. This talk traces the evolution of network fingerprinting, beginning with passive tools like p0f and advancing through modern methods such as JA3/JA4, JA4+, and MuonFP.

We’ll demonstrate how each fingerprint reflects subtle variations in the TCP handshake and TLS ClientHello - and how an appreciation for what happens “under the hood” in your OS’s network stack can help you extract even richer signals. You’ll see real-world examples of identifying fast scanners, simple banner-grabbers, VPN tunnels, and jump-server connections.

By the end, you’ll know how to integrate these fingerprints into your security workflows - where they shine, where they fall short, and how they can both harden your defenses and help you avoid detection by public scanning services. Attendees will leave with examples they can apply immediately to protect critical infrastructure.

An understanding of the TCP three-way handshake and of a TLS ClientHello (plus a high-level familiarity with the Linux or Windows network kernel stack, for extra fun) is all you need to get the most out of this session.