Glossary

Plain-language definitions of the packet capture and network forensics terms used in our guides.

DNS tunnelling: DNS tunnelling carries data inside DNS queries and responses, typically in long encoded subdomains of one domain. It is detected by volume and name shape.
5-tuple: A 5-tuple identifies a network flow by protocol, source address, source port, destination address and destination port. It is the key of a conversation.
IOC (indicator of compromise): An IOC is an observable artifact, such as an IP address, domain, URL or file hash, associated with malicious activity and used to search for it elsewhere.
JA3: JA3 is a TLS client fingerprint: the MD5 hash of the version, ciphers, extensions, curves and point formats in a ClientHello, in the order sent.
JA4: JA4 is FoxIO's TLS client fingerprint: a readable prefix plus truncated SHA-256 hashes of sorted ciphers and extensions, stable under reordering.
Link-layer type (LinkType / DLT): The link-layer type is the number in a capture file that says how each packet's first bytes are framed: Ethernet, Linux cooked, raw IP, loopback and so on.
pcap: pcap is the classic packet capture file format: a 24-byte header followed by timestamped packet records, with one link type and snaplen per file.
pcapng: pcapng (PCAP Next Generation) is a block-based capture format that stores several interfaces, per-interface timestamp resolution and metadata.
Snaplen (snapshot length): The snaplen is the maximum number of bytes a capture keeps from each packet; anything past it is discarded at capture time and cannot be recovered.
SNI (Server Name Indication): SNI is the TLS extension in which a client names the server host it wants. It is visible in the ClientHello and shows the destination of encrypted sessions.
TCP reassembly: TCP reassembly rebuilds the byte stream of a TCP connection from captured segments, handling retransmissions, out-of-order packets and gaps.
TLS ClientHello: The ClientHello is the first TLS handshake message. It is sent unencrypted and lists versions, cipher suites, extensions, SNI and ALPN offered by the client.