I've sniffed several TLS/SSL communication with Wireshark, and I want to find out which cipher suites are proposed by client and which one chosen by server. How do I do that?

Here you have some of what I have sniffed: enter image description here

EDIT: Here are the first packets: enter image description here

  • In the bottom pane of wireshark you have the message breakdown, there you can see the first negotiation. – grochmal Oct 3 '16 at 21:58
  • Which one should I click on? I can't see the first negotiation. The first packet has the protocol TCP – user4118143 Oct 3 '16 at 22:00
  • Check the first Client Hello and the first Server Hello. – Limit Oct 3 '16 at 23:12
  • Ok, when I do that what should I look at in the message? – user4118143 Oct 4 '16 at 7:15

The client offers a list of cipher suites in the first message it sends, called ClientHello.

ClientHello where cipher suites are proposed by client

The server offers a single ciphersuite it chose from the list offered by the client, in the first message the server sends, called ServerHello.

ServerHello where server choses cipher suite

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.