8

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the number of clients who connect with this level of encryption.

Therefore I would like to know how to filter incoming communications with different encryption methods like TLS 1. 0, 1. 1 and 1. 2. If there is a different method to identify or quantify these communications which will be easier than whireshark I would be glad to hear about it.

1 Answer 1

9

Try filtering by tls.record.version

For example, if you wanted to only display TLS v1.2 traffic then you could run tls.record.version == 0x0303

You can choose from the hex values below for the version that fits your needs.

Versions:

  • 0x0300 SSL 3.0
  • 0x0301 TLS 1.0
  • 0x0302 TLS 1.1
  • 0x0303 TLS 1.2

To avoid using the GUI or to automate this further you could also filter by using tshark.


Resources:

Traffic Analysis of an SSL stash TLS session

Thank you, Duncan Howe for the update.

2
  • The ideal solution would be a capture filter which would ignore all connections but the ones you're interested in
    – Ro Yo Mi
    Jul 7, 2021 at 12:52
  • 1
    For later versions of Wireshark (not sure which version brought this in) the filter is now tls.record.version; the values remain the same though Feb 22, 2023 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .