Skip to main content

Dendrite

See every connection. Know every client.

Dendrite is the sensor layer at the heart of every Gen0Sec deployment. It captures every connection on the wire and identifies what's on it — what client made it, what tool sent it, what protocol it used. The fingerprints it produces feed everything else: rules, ML, alerts.

Synapse agent — capture only, no enforcementNetworktraffic onthe wireLinux captureAF_PACKET · PF_RINGTC eBPF · TC egressin-process TLS readpick at deploy timeWindows captureNDISAF_XDPhandshake trackingParseprotocol fieldsfrom the framenever decrypts a sessionJA4+ fingerprintsJA4 · JA4S TLS client / serverJA4T · JA4TS TCP client / serverJA4H HTTP headersJA4L latency, distanceJA4SSH SSH sessionJA4X X.509 certificateJA4D · JA4D6 DHCP / DHCPv6ten types, both sides of the conversationCortexclassifiesAmygdalablocks onThalamusinspectsCaptureProcessingFingerprintsBoundaryNetworktraffic on the wireCaptureLinux: AF_PACKET, PF_RING,TC eBPF, in-process TLSWindows: NDIS, AF_XDPpick at deploy timeParseprotocol fields from the framenever decrypts a sessionTen JA4+ fingerprintsJA4 · JA4S TLSJA4T · JA4TS TCPJA4H HTTP JA4L latencyJA4SSH JA4X JA4D JA4D6both sides of the conversationtoCortex · Amygdala · Thalamusclassify · block on · inspectCaptureProcessingFingerprintsConsumers
Capture only — Dendrite observes and parses; it never blocks.

What Dendrite is for​

  • Identify clients without IPs. JA4+ fingerprints describe the client, not the address. The same tool from a hundred rotating IPs has the same fingerprint.
  • The full JA4+ suite. Ten fingerprint types across TCP, TLS, HTTP, SSH, DHCP and X.509 — both halves of each conversation, not just the client side.
  • Read TLS plaintext without terminating TLS. Dendrite hooks the library, not the connection, so it sees decrypted bytes with no proxy, no re-encryption and no private keys.
  • Linux and Windows. One API across both. The capture backends differ, because the kernels do.

Capture only, by design​

Dendrite has no enforcement code, no firewall and no proxy. It observes and parses; consumers like Amygdala and Hillock decide what to do with the events.

That boundary is deliberate and enforced in the code — fingerprint blocking was deliberately removed from Dendrite and lives downstream. A bug in a sensor should cost you visibility, never availability.

The fingerprints​

TypeCoversExample
JA4TLS Client Hellot13d1516h2_8daaf6152771_e5627efa2ab1
JA4STLS Server Hellot1302h2_1301_a56c5b993250
JA4TTCP SYN — the client's stack65535_2-4-8-1-3_1460_7
JA4TSTCP SYN-ACK — the server's stack65535_2-4-8_1460_0
JA4HHTTP request headersge11cr15enus_a1b2c3d4e5f6_…
JA4LLatency and distance12500_64_407
JA4SSHSSH session behaviourc14s14_c14s14_c14s14
JA4XX.509 certificateaae71e8db6d7_b186095e22b6_…
JA4DDHCP (IPv4)disco_8_a1b2c3d4e5f6_000000000000
JA4D6DHCPv6solicit_6_a1b2c3d4e5f6_…

Every type parses back from its string form and supports wildcard patterns, so a rule can match a family of clients rather than one exact build.

How it captures​

Capture backends are selected at build time, so an agent carries only what it uses.

PlatformBackendWhat it gets you
LinuxAF_PACKETWorks on any kernel, no extra modules. The default
LinuxPF_RINGZero-copy, for high-rate links. Needs pf_ring.ko
LinuxTC eBPFJA4TS, JA4L, JA4S and JA4SSH computed in-kernel
LinuxuprobeTLS plaintext from the process, before it hits the wire
LinuxTC egressMirrors outbound payloads to Thalamus for inspection
WindowsNDISPacket capture through the Windows Packet Filter driver
WindowsAF_XDPHigh-rate capture path
WindowsuserspaceJA4L handshake tracking, the equivalent of the Linux TC program

Reading TLS without breaking it​

Most tooling sees TLS as opaque, or terminates it and takes on the keys. Dendrite does neither: it attaches to the TLS library inside the process and reads the plaintext the application already has.

RuntimeHow
OpenSSL, BoringSSL, LibreSSLuprobe on SSL_read / SSL_write
GnuTLSuprobe on gnutls_record_recv / gnutls_record_send
NSSuprobe on PR_Read / PR_Write
Go crypto/tlsuprobe resolved through .gopclntab
Java JSSEJVMTI agent
.NET SslStreamCovered by the OpenSSL hooks on Linux

This needs a dynamically linked TLS library. A binary that statically links its TLS stack exposes no symbol to attach to, and Dendrite falls back to wire-level fingerprints for it.

How it fits​

Dendrite is the sensor. Everything else in the platform — Cortex's predictions, Amygdala's rules, Cerebellum's correlations — operates on the fingerprints Dendrite produces.

Use cases​

  • Identify a credential-stuffing tool across rotating IPs by its TLS fingerprint.
  • Detect a new bot family by spotting fingerprints with no historic baseline.
  • Audit your own client fleet — Dendrite shows you which TLS libraries your services actually negotiate with, and JA4TS tells you what your servers look like from outside.
  • Inspect application-layer traffic that never appears in cleartext on the wire, without standing up a proxy.

See also​