What is the difference between the basic macOS mode and packet capture?

The basic mode sees connections, timing and volumes; packet capture also reads the unencrypted fields of the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake, which some features need. On macOS, the agent runs in a basic mode that observes the connections of the Mac it is installed on. That is enough for the core detections, such as beaconing, scanning, lateral movement and unusual outbound volume. Packet capture means the agent copies the packets themselves to read a few protocol fields, still without decrypting anything. It is available where the agent runs on Linux, or as a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. Two features depend on it: TLS fingerprinting, from the Starter plan, which recognises known malware clients by their handshake, and the NQCI crypto inventory, active from the Pro plan, which reports quantum-vulnerable and hybrid key exchange. If you need either, plan a Linux agent or a mirror-port sensor.

← All 20 questions on NetSenX: plans and set-upAll topics