As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of encryption, therefore I would like know how to filter incoming communications with different encryption methods like TLS 1. 0, 1. 1 and 1. 2. If there is a different method to identify or quantify these communications which will be easier then whireshark I would be glad to hear about it, thank you!


Try filtering by ssl.record.version

For example, if you wanted to only display TLS v1.2 traffic then you could run ssl.record.version == 0x0303

You can choose from the hex values below for the version that fits your needs.


  • 0x0300 SSL 3.0
  • 0x0301 TLS 1.0
  • 0x0302 TLS 1.1
  • 0x0303 TLS 1.2

To avoid using the GUI or to automate this further you could also filter by using tshark.


  • The ideal solution would be a capture filter which would ignore all connections but the ones you're interested in
    – Ro Yo Mi
    Jul 7 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.