Indicators from a capture
Pull addresses, names, and fingerprints you can defend. Leave out the resolver, the broadcast, and anything you cannot tie to a frame.
What is worth lifting
An indicator from a capture is a value you can point at in a frame, plus the time and the capture point. Useful ones from a lab file are: a destination address that is not part of the lab inventory, a DNS query name, a TLS server name, an HTTP host and user agent on a cleartext service, a JA3 fingerprint when the field is present, and a certificate subject when the handshake left it visible. tls.handshake.ja3 is a hash of the Client Hello’s offered parameters. It describes a client stack. It does not, alone, name a program.
Skip the noise on purpose. The lab resolver, the gateway, broadcast and multicast, DHCP from the known server, and NTP to a host you operate are context. A list that includes them trains people to ignore the list. Write a short “excluded, because” line so the omission is a choice.
tls.handshake.type == 1 && ip.src == 10.8.0.40
Extract, then deduplicate
Use the conversations list for addresses and ports, and tshark fields for names. Sort and unique the text in the case notes. A name that appears once and a name that appears two thousand times are different leads, so keep a count. Keep the first and last time you saw each value.
JA3 and JA3S need a Wireshark build that dissects them, which current releases do. If the field is missing, say the build did not produce it, and fall back to the server name and the address. Do not invent a fingerprint by hand from a screenshot.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1 && ip.src == 10.8.0.40" -T fields -e frame.time_epoch -e ip.dst -e tcp.dstport -e tls.handshake.extensions_server_name -e tls.handshake.ja3 -E header=y -E separator=,
Worked case: three destinations, one of them unexpected
The client 10.8.0.40 in a twenty-minute lab file talks to 10.8.0.53 on UDP/53, to 10.8.0.20 on TCP/443 with server name lab.example, and to 203.0.113.50 on TCP/443 with server name files.example.test. Inventory says the first two are the resolver and the lab web server. The third is not on the list. JA3 is identical on the two TLS destinations, which fits one browser talking to two names. You record the third address, the server name, the ports, the first and last timestamps, and the JA3 as a description of the client.
You do not record 10.8.0.53 as an indicator. You do not paste the pcapng into the ticket. The indicator line is enough for someone to search logs, and the file stays with the engagement notes. If the unexpected name had been a CDN in front of a lab service you forgot, the inventory update closes it. The capture’s job was to make the discrepancy visible.
Indicators inherit the file’s secrets
A sloppy field list can include an Authorization header or a cookie. Choose the -e list on purpose. Review the CSV before it leaves the case folder. A server name is usually shareable with the defenders who own the host. A cleartext password is not an indicator. It is an incident about the service, handled in the credentials lesson.
An indicator is a lead. The same address can be a sinkhole, a lab service, or a destination a person chose. The capture shows that this host talked to it at this time. The people who own the host decide what that means.
Diagram
From a conversation list to a short set of values with times
- Inventory
Mark the resolver, the gateway, and the lab services as context, not as indicators.
- Names
Extract DNS names, server names, and unexpected destinations with timestamps.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1 && ip.src == 10.8.0.40" -T fields -e ip.dst -e tls.handshake.extensions_server_name
- Count
Keep a count and the first and last time. Drop values you cannot tie to a frame.
- Store
File the CSV with the pcapng. Keep credentials out of the column list.
Check yourself
1. Which value earns a place on the indicator list from this lab file?
2. What does tls.handshake.ja3 represent?
3. The cleartext lab login contains a cookie. Should that cookie be a column in the indicator CSV?