As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the number of clients who connect with this level of encryption.

Therefore I would like to know how to filter incoming communications with different encryption methods like TLS 1. 0, 1. 1 and 1. 2. If there is a different method to identify or quantify these communications which will be easier than whireshark I would be glad to hear about it.

1 Answer 1


Try filtering by tls.record.version

For example, if you wanted to only display TLS v1.2 traffic then you could run tls.record.version == 0x0303

You can choose from the hex values below for the version that fits your needs.


  • 0x0300 SSL 3.0
  • 0x0301 TLS 1.0
  • 0x0302 TLS 1.1
  • 0x0303 TLS 1.2

To avoid using the GUI or to automate this further you could also filter by using tshark.


Traffic Analysis of an SSL stash TLS session

Thank you, Duncan Howe for the update.

  • The ideal solution would be a capture filter which would ignore all connections but the ones you're interested in
    – Ro Yo Mi
    Commented Jul 7, 2021 at 12:52
  • 1
    For later versions of Wireshark (not sure which version brought this in) the filter is now tls.record.version; the values remain the same though Commented Feb 22, 2023 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .