{
  "time": "2026-10-29T22:08:12.079727456Z",
  "client": {
    "ip": "216.73.216.222",
    "port": 1346,
    "proxy_note": "address from the haproxy proxy-v2 header (real client)"
  },
  "http": {
    "proto": "HTTP/2.0",
    "method": "GET",
    "path": "/",
    "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
    "headers": [
      {
        "name": "User-Agent",
        "value": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
      },
      {
        "name": "Accept-Encoding",
        "value": "gzip, br, zstd, deflate"
      },
      {
        "name": "Accept",
        "value": "*/*"
      }
    ]
  },
  "tls": {
    "negotiated_alpn": "h2",
    "negotiated_cipher_suite": "TLS_AES_128_GCM_SHA256 (0x1301)",
    "negotiated_version": "TLS 1.3",
    "sni": "test.auto-gram.ru",
    "alpn_offered": "h2, http/1.1",
    "ja3_string": "771-4866,4865,4867,49196,49195,52393,49200,49199,52392,255-13,23,5,35,43,0,45,10,51,16,11-29,23,24-0",
    "ja3_hash": "74fcb4e477edae5b35555a5d3c2c982a",
    "ja4": "t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3",
    "ja4_r": "t13d1011h2_1302,1301,1303,c02c,c02b,cca9,c030,c02f,cca8,00ff_000d,0017,0005,0023,002b,0000,002d,000a,0033,0010,000b_0503,0403,0807,0806,0805,0804,0601,0501,0401",
    "ja4_sha256": "b149cae3f32c81ba6e761df2e5a7a476251f643fd18454716da29bedce5c1c66",
    "client_version": "0303",
    "supported_versions": "[0304, 0303]",
    "cipher_suites": "[1302, 1301, 1303, c02c, c02b, cca9, c030, c02f, cca8, 00ff]",
    "signature_algorithms": "[0503, 0403, 0807, 0806, 0805, 0804, 0601, 0501, 0401]",
    "supported_groups": "[001d, 0017, 0018]",
    "ec_point_formats": "[0000]",
    "extensions": [
      {
        "id": "000d",
        "name": "signature_algorithms",
        "len": 20,
        "data_hex": "0012050304030807080608050804060105010401"
      },
      {
        "id": "0017",
        "name": "extended_master_secret",
        "len": 0
      },
      {
        "id": "0005",
        "name": "status_request",
        "len": 5,
        "data_hex": "0100000000"
      },
      {
        "id": "0023",
        "name": "session_ticket",
        "len": 0
      },
      {
        "id": "002b",
        "name": "supported_versions",
        "len": 5,
        "data_hex": "0403040303"
      },
      {
        "id": "0000",
        "name": "server_name",
        "len": 22,
        "data_hex": "0014000011746573742e6175746f2d6772616d2e7275"
      },
      {
        "id": "002d",
        "name": "psk_key_exchange_modes",
        "len": 2,
        "data_hex": "0101"
      },
      {
        "id": "000a",
        "name": "supported_groups",
        "len": 8,
        "data_hex": "0006001d00170018"
      },
      {
        "id": "0033",
        "name": "post_handshake_auth",
        "len": 38,
        "data_hex": "0024001d0020375e0090885769b14b9a43730241f2b86648c14f434f2c41e2bfc65694e3f626"
      },
      {
        "id": "0010",
        "name": "application_layer_protocol_negotiation",
        "len": 14,
        "data_hex": "000c02683208687474702f312e31"
      },
      {
        "id": "000b",
        "name": "ec_point_formats",
        "len": 2,
        "data_hex": "0100"
      }
    ],
    "client_hello_bytes": 262,
    "client_hello_hex": "1603010101010000fd0303029164d0a0716344d2bc52083e8c1b974f28672318a2fa80e2f26acfc8a846e2206c126f67d8f779cb4fe14e4b0e6b4ad38cdd5c3e4cc09b5d72444999c61d6b890014130213011303c02cc02bcca9c030c02fcca800ff010000a0000d001400120503040308070806080508040601050104010017000000050005010000000000230000002b00050403040303000000160014000011746573742e6175746f2d6772616d2e7275002d00020101000a00080006001d00170018003300260024001d0020375e0090885769b14b9a43730241f2b86648c14f434f2c41e2bfc65694e3f6260010000e000c02683208687474702f312e31000b00020100"
  },
  "transport": {
    "note": "no packets matched client ip:port yet (LAN hairpin usually works; check -iface)"
  },
  "notes": [
    "HTTP header order and h2 SETTINGS/frames are not shown live: Go's h2 server does not expose them — capture wire-side (keylog + tshark) for that",
    "everything above is what the server really received: TLS from the peeked ClientHello bytes, TTL/SYN from AF_PACKET on the WAN interface, headers from the request"
  ]
}