application_settings_old
The old code point (17513) of the ALPS extension. Only the outdated curl-impersonate chrome116 profile sends it.
What it is
application_settings_old (extension 17513, 0x4469) is the code that BoringSSL first used for ALPS, the Application-Layer Protocol Settings extension proposed in the draft-vvv-tls-alps Internet-Draft. ALPS lets client and server exchange application settings, such as HTTP/2 SETTINGS, inside the TLS handshake.
The draft expired without an IANA assignment, and newer Chrome versions switched to code 17613, which our test shows as application_settings. BoringSSL added the new code point because older Chrome builds could hit an overflow bug in Chrome's ALPS decoder with the original one. Our test labels the earlier number application_settings_old so the two are easy to tell apart.
Because the code moved, the old number now works as a dating mark: a ClientHello with 17513 comes from a Chrome build, or a copy of one, made before the switch.
Our test still recognizes the old number because older impersonation profiles, such as curl-impersonate chrome116 in our data, keep sending it.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 1 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our measurements only curl-impersonate chrome116 sends it, as its 3rd extension. Chrome 153 and curl_cffi send the new code 17613 instead. A client that claims to be a current Chrome but sends 17513 is using an old impersonation profile.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for application_settings_old in the TLS details.
Run the TLS fingerprint test