{"record":{"id":"d4431c3a0f11320b","repo":"gchq/CyberChef","slug":"not-a-server-hello","errorCode":null,"errorMessage":"Not a Server Hello.","messagePattern":"Not a Server Hello\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JA3SFingerprint.mjs","lineNumber":77,"sourceCode":"        input = Utils.convertToByteArray(input, inputFormat);\n        const s = new Stream(new Uint8Array(input));\n\n        const handshake = s.readInt(1);\n        if (handshake !== 0x16)\n            throw new OperationError(\"Not handshake data.\");\n\n        // Version\n        s.moveForwardsBy(2);\n\n        // Length\n        const length = s.readInt(2);\n        if (s.length !== length + 5)\n            throw new OperationError(\"Incorrect handshake length.\");\n\n        // Handshake type\n        const handshakeType = s.readInt(1);\n        if (handshakeType !== 2)\n            throw new OperationError(\"Not a Server Hello.\");\n\n        // Handshake length\n        const handshakeLength = s.readInt(3);\n        if (s.length !== handshakeLength + 9)\n            throw new OperationError(\"Not enough data in Server Hello.\");\n\n        // Hello version\n        const helloVersion = s.readInt(2);\n\n        // Random\n        s.moveForwardsBy(32);\n\n        // Session ID\n        const sessionIDLength = s.readInt(1);\n        s.moveForwardsBy(sessionIDLength);\n\n        // Cipher suite\n        const cipherSuite = s.readInt(2);","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JA3SFingerprint.mjs#L59-L95","documentation":"JA3SFingerprint reads the handshake type byte and requires 2 (ServerHello). A ClientHello (type 1) or any other handshake type throws. readInt returning undefined on short input also satisfies the !== check.","triggerScenarios":"The record is a ClientHello or another handshake message rather than a ServerHello; you fed JA3S a client-side capture. Also when inputFormat mismatch makes the type byte garbage or slicing is off by one.","commonSituations":"Using JA3S (server) on a client capture instead of JA3; off-by-one slicing; inputFormat mismatch; feeding a Certificate/ClientHello record.","solutions":["For a ClientHello, use JA3 Fingerprint, not JA3S.","Confirm the record is a ServerHello (type byte === 2).","Re-slice so parsing starts at the record content-type byte.","Match inputFormat to the real data."],"exampleFix":"// before\nja3s.run(clientHelloRecord, ['Hex','Base64']); // type byte 1 -> Not a Server Hello.\n// after\nja3.run(clientHelloRecord, ['Hex','Base64']); // use the Client Hello op","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertServerHello(input, inputFormat) {\n  const b = Utils.convertToByteArray(input, inputFormat);\n  if (b.length < 6) throw new Error('record too short');\n  if (b[5] !== 2) {\n    throw new Error(`Handshake type ${b[5]} is not ServerHello (2). For ClientHello use JA3.`);\n  }\n  return b;\n}","typeGuard":"function isServerHello(bytes) {\n  return bytes.length >= 6 && bytes[0] === 0x16 && bytes[5] === 2;\n}","tryCatchPattern":null,"preventionTips":["Use JA3S only on ServerHello (type 2); use JA3 for ClientHello.","Confirm the type byte before running.","Re-slice so parsing starts at the content-type byte.","Match inputFormat to the real data."],"tags":["tls","network","parsing","cyberchef","input-validation","ja3s"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}