Yeah basically you need to sniff the HTTP connections, drop everything but the headers you need to calculate the ja3