NetworkMiner: the hosts view, and which guesses to trust

What was actually seen

Each host row collects an IP address, frames and sessions that used it, hostnames heard in DNS, DHCP, or NetBIOS, and a MAC address when the capture was on a segment where MAC addresses were visible. A hostname is only as good as the protocol that carried it. DNS for files.lab.internal pointing at 10.8.0.77 means that answer was in the file, which you already know how to check in dns.log.

Open ports in this view are ports that appeared in the capture. The tool did not complete a handshake of its own to test them. A port missing from the list may simply have been quiet during the file. Report observed traffic, not a full exposure map.

What is a guess

Operating-system fields come from passive fingerprint databases such as Satori and p0f. They are useful leads and they are wrong often enough that a ticket should call them a guess. The owner's inventory, or a banner the owner already logs, is the confirmation. A MAC vendor lookup names the organization that registered the NIC's prefix. It does not name the person at the keyboard, and it is invisible in a capture taken on a routed hop that no longer has Ethernet headers.

When the hostname, the address, and the inventory disagree, write the disagreement down. That disagreement is often the whole finding, as with a lab name that resolved to the staging VM.

• Trust the address and the session list first.
• Treat the OS field as a hypothesis.
• Treat the MAC vendor as a NIC prefix, present only when the frame had a MAC.
• A hostname sourced from DNS can be checked against Zeek's dns.log for the same file.

A worked defensive case

Hosts shows 10.8.0.77 with hostname files.lab.internal, an OS guess of a Linux vintage the lab retired, and sessions only with 10.8.0.20. The inventory spreadsheet says files.lab.internal should be 10.8.0.40, which also appears, with no sessions from the web tier during the file.

You file the hostname and address as observed, and you file the OS string as a guess that happens to match the old staging image. The owner corrects DNS and replaces that image. You do not write that NetworkMiner proved the kernel version. The sessions list is what proved the web tier talked to 10.8.0.77.

Where this is documented

Netresec documents passive OS fingerprinting via Satori and p0f, and hostname extraction from captured protocols. The distinction between an observed session and a fingerprint is the one to keep in the ticket.

Use a host-only lab network, or a capture the owner already handed you. These commands read that file or record a single lab host. They are not a scan of the public internet.

Commands

zeek-cut -m id.orig_h query answers < /lab/zeek/dns.log