Do you have the key information needed to view the TLS data?
Wireshark$ tshark -r ./rsasnakeoil2.pcap -z follow,tls,hex,0 -q | head -10
===================================================================
Follow: tls,hex
Filter: tcp.stream eq 0
Node 0: 127.0.0.1:38713
Node 1: :0
00000000 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a GET / HT TP/1.1..
00000010 48 6f 73 74 3a 20 6c 6f 63 61 6c 68 6f 73 74 0d Host: lo calhost.
00000020 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a .User-Ag ent: Moz
00000030 69 6c 6c 61 2f 35 2e 30 20 28 58 31 31 3b 20 55 illa/5.0 (X11; U
Wireshark$
Wireshark$ tshark -G currentprefs | grep -i snakeoil
tls.keylog_file: C:\Users\admin\Documents\Wireshark\wireshark-3.2.6\wireshark\test\keys\rsasnakeoil2.key
Wireshark$
Test files available in the Gitlab repository test data
"What does 428 mean in (tcp.stream eq 428) how to detect and specify this number in wireshark ????"tcp.stream is a Wireshark generated field (has square brackets [ ] around it) found in the packet details under TCP (Transmission Control Protocol)
[Stream index: 0]
j'ai un pcap file filtrer avec ssl.handshake.type.extension-server_name=="bla bla" ..ce filter en output 1 client hello ensuite je faire suivre tls stream ===> tous ce la dans interface graphique wireshark ...mon but de faire tous cela avec terminal ===> script bash
"I have a pcap file to filter with ssl.handshake.type.extension-server_name == "bla bla" .. this filter in output 1 client hello then I forward tls stream ===> all this in wireshark GUI. ..my goal to do all of this with terminal ===> bash script"
$ tshark -r ./ultpcap2.pcapng -T fields -e tcp.stream -e tls.handshake.extensions_server_name -Y tls.handshake.extensions_server_name
88 ip.webernetz.net
90 dovecot.weberlab.de
110 ip.webernetz.net
113 random.weberlab.de
114 random.weberlab.de
$
$ tshark -r ./ultpcap2.pcapng -T fields -e tcp.stream -Y "tls.handshake.extensions_server_name==ip.webernetz.net"
88
110
$
Asked: 2020-11-13 02:06:03 +0000
Seen: 433 times
Last updated: Nov 13 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
Google translate:
"how to follow tls stream eq ?? of a specific package with command line tshark ... i need to follow tls stream of a wireshark package in my Bash script ...... how do I make this result ????"