Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

TLS Handshake Ciphersuite: how to extract `showname` string using tshark?

I am trying to extract sensible information from the TLS header of a packet. Right now, I am using tshark and obtaining integer values, which for the example data below, would be 10. Is there a mapping between integers and cipher suites? for example:

int        cipher_suite
10         TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
...        ...
k          XYZ


 <field name="tls.handshake.ciphersuite" showname="Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)" size="2" pos="164" show="10" value="000a"/>