// network

what is ALPN and negotiated HTTP version?

The ALPN protocol list offered in the TLS handshake and the HTTP version actually negotiated. Every seeded egress offered and negotiated h2; a tool that can only offer http/1.1 against an h2 site is a coarse transport tell.. h3/QUIC was not exercised in the seed (all JA4 <a> segments start with 't' = TCP).