As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of encryption, therefore I would like know how to filter incoming communications with different encryption methods like TLS 1. 0, 1. 1 and 1. 2. If there is a different method to identify or quantify these communications which will be easier then whireshark I would be glad to hear about it, thank you!
Try filtering by
For example, if you wanted to only display TLS v1.2 traffic then you could run
ssl.record.version == 0x0303
You can choose from the hex values below for the version that fits your needs.
- 0x0300 SSL 3.0
- 0x0301 TLS 1.0
- 0x0302 TLS 1.1
- 0x0303 TLS 1.2
To avoid using the GUI or to automate this further you could also filter by using