Passive Fingerprinting of HTTP/2 Clients
summary
Akamai analyzes 10 million HTTP/2 connections and extracts fingerprints for over 40,000 user agents across hundreds of implementations, using defaults sent at connection time: settings frame values, initial window update amounts, optional priority frame trees and the order of pseudo headers. Logs come from nghttpd and client tools like curl; distinct, repeatable fingerprints map to browsers, libraries and OSes, let attackers or defenders spot impersonation, shared-IP proxies or anomalous fleets, and explain why many security tools still miss HTTP/2 traffic.
AI-written summary · about
chapters (13)
- 0:00Start
- 3:44Research Data
- 4:13HTTP/2 Overview
- 4:56HTTP/1.x Challenges
- 7:45HTTP/2 Connection
- 9:38HTTP/2 Key Elements
- 10:44Frame Structure
- 11:59Client Side
- 33:40Use Cases
- 35:01Attack Landscape
- 35:13Tools of the Trade
- 36:58Key Takeaways
- 37:48Questions
related talks
48mPassive Fingerprinting of HTTP/2 Clients
43mPassive Fingerprinting of HTTP/2 Clients.
44mPassive Fingerprinting of HTTP/2 Clients
01h 00mHTTP/2 : What you need to know
20mA quick primer on http2
49mSecurity and Insecurity of HTTP Headers
54mDetecting and managing bot activity more efficiently
47mHTTP 2.0 from the Developer's Viewpoint