Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Where can I find the TLS version that is being sent from the client through the ClientHello to the server?

I am a bit confused where exactly to get the TLS version value that is sent in the ClientHello from? Wireshark has three places where versions appear, and they are not unified in a single handshake.

There is a version under the the "record", under the "handshake", and one in the "Protocol" in the view. I strongly believe that the handshake version is the one being negotiated. However, which version is the one that appears in the "Protocol" column in the view? What affects this value? Also what does affect the version in the "record"?