Ask Your Question

Display filter for TLS versions in tshark and saving to a new file.

asked 2019-06-18 10:04:31 +0000

xinxolHH gravatar image

updated 2019-06-18 11:44:32 +0000


I have a long-term capture taken on a server which at the moment is set-up to accept several versions of TLS, 1.1, 1,2 and older ones from outdated clients. The clients are connecting to the server using diferent protocols and ports, 443, 4343, 3389, 22 (HTTPS, RDP, SSH, FTPS mainly) and I try to indentify which versions of TLS are those clients using and which level of encryption.

I have used "ssl.record.version" for each trace on the graphical interface, but as number of traces files increases,(~162 files, ~28 Gb of traces), I would like to use tshark to read the capture files and to be able to display those packets which contain TLS handshake, indepently of the protocol, or port. I think I have done it, using -r and -Y, but it's strange to me that when displaying on the screen I see the packet flows with different TLS versions

tshark -r LANInterfaceServer104.pcapng -Y ssl.record.version

8222 ------ TLSv1 571 Client Hello

26953 ------- TLSv1.2 437 Certificate, Server Key Exchange, Server Hello Done

38554 -------- TLSv1.3 1414 Server Hello, Change Cipher Spec

but then saving to a file, it has something different, I only find one TLS version, not all the packets are saved, and only those are in the new trace file created.

tshark -r LANInterfaceServer104.pcapng -Y ssl.record.version -w TracewithTLS_versions.pcapng

I wonder if this could be just because of the packets beloging to only one handshake are saved, or my filter commands are not properly correct.

and additional question, I have also used TraceWrangler to scan, filter and extract the traces by ports, but I wonder if could be an option to implement a filter to extract any TLS handshake version as well and creating the file.

I see the advantage of having such information in just one file, in order to identify the client IP, and application which have to be "corrected"

Thanks in advanced.

edit retag flag offensive close merge delete


tshark version?

grahamb gravatar imagegrahamb ( 2019-06-18 10:14:57 +0000 )edit

TShark (Wireshark) 3.0.2 (v3.0.2-0-g621ed351d5c9)

xinxolHH gravatar imagexinxolHH ( 2019-06-18 10:16:05 +0000 )edit

Be aware that from Wireshark 3.0 onwards, the SSL dissector has been renamed to TLS, so display filter fields should be prefixed with "tls" rather than "ssl".

grahamb gravatar imagegrahamb ( 2019-06-18 10:40:56 +0000 )edit

thanks, it is nice to have tls intead of ssl, yes finally, but I think when using tls.record.version I am getting the same outcome. tshark -r LANInterfaceServer104.pcapng -Y tls.record.version -w traceswithTLS.pcapng, is there something strange in my filters, or is this probably a bug.

xinxolHH gravatar imagexinxolHH ( 2019-06-18 11:19:22 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-06-19 00:56:10 +0000

Lekensteyn gravatar image

updated 2019-06-19 00:56:23 +0000

TLS negotiates the TLS version during the handshake. The client reports its minimum version through the tls.record.version field and the server agrees to it in the Server Hello. If you would like to understand what versions are in use, it suffices to extract TLS Server Hello handshake messages using the filter:


Then inspect the Server Hello version field:


or for TLS 1.3:


For example, to extract both version fields for Server Hello messages, it will show something like 0x00000303 (for TLS 1.2) or 0x00000304 0x00000303 (for TLS 1.3):

tshark -r your.pcapng -T fields -Y tls.handshake.type==2 -e tls.handshake.extensions.supported_version -e tls.handshake.version

Alternatively you can dump the Protocol column like this, it will show something like TLSv1.2 or TLSv1.3:

tshark -r your.pcapng -T fields -Y tls.handshake.type==2 -e _ws.col.Protocol

For more details on the version negotiation, including TLS 1.3 considerations, see this answer.

edit flag offensive delete link more


Thanks!, this is closer to what I was looking for, I have added the ip.src on the fields so I can get the "dump" with each line with the correspoding ip address on the screen in a text file. I am bit surprise that it is not possible to have a written pcapng file with only those handshake packets. Thanks & Best Regards.

xinxolHH gravatar imagexinxolHH ( 2019-06-19 07:02:53 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-06-18 10:04:31 +0000

Seen: 12,183 times

Last updated: Jun 19 '19