Do you have the key information needed to view the TLS data?
Wireshark$ tshark -r ./rsasnakeoil2.pcap -z follow,tls,hex,0 -q | head -10
===================================================================
Follow: tls,hex
Filter: tcp.stream eq 0
Node 0: 127.0.0.1:38713
Node 1: :0
00000000 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a GET / HT TP/1.1..
00000010 48 6f 73 74 3a 20 6c 6f 63 61 6c 68 6f 73 74 0d Host: lo calhost.
00000020 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a .User-Ag ent: Moz
00000030 69 6c 6c 61 2f 35 2e 30 20 28 58 31 31 3b 20 55 illa/5.0 (X11; U
Wireshark$
Wireshark$ tshark -G currentprefs | grep -i snakeoil
tls.keylog_file: C:\Users\admin\Documents\Wireshark\wireshark-3.2.6\wireshark\test\keys\rsasnakeoil2.key
Wireshark$
Test files available in the Gitlab repository test data
"What does 428 mean in (tcp.stream eq 428) how to detect and specify this number in wireshark ????"tcp.stream is a Wireshark generated field (has square brackets [ ] around it) found in the packet details under TCP (Transmission Control Protocol)
[Stream index: 0]
Asked: 2020-11-13 02:06:03 +0000
Seen: 635 times
Last updated: Nov 13 '20
Google translate:
"how to follow tls stream eq ?? of a specific package with command line tshark ... i need to follow tls stream of a wireshark package in my Bash script ...... how do I make this result ????"