Wireshark SSL Filters: Cutting Through the Crypto Noise
David Zhang
- One minute read - 208 wordsIf you are capturing network traffic and need to isolate specific SSL/TLS handshake messages, the right Wireshark display filter saves you from scrolling through thousands of unrelated packets. Below are the most commonly used filters for each handshake message type, along with a full reference table and a note on cipher suite limitations.
Client Hello
ssl.handshake.type == 1Server Hello
ssl.handshake.type == 2NewSessionTicket
ssl.handshake.type == 4Certificate
ssl.handshake.type == 11CertificateRequest
ssl.handshake.type == 13ServerHelloDone
ssl.handshake.type == 14The presence of a ServerHelloDone message indicates a full-handshake TLS session (as opposed to a session resumption).
Cipher Suites
ssl.handshake.ciphersuiteMany new and existing deployments require more secure mechanisms, such as Perfect Forward Secrecy. To provide PFS, the cipher suite must leverage Elliptic-curve Diffie-Hellman (ECDH) or Ephemeral Diffie-Hellman during the key exchange. In those cases, you cannot use the private key to decrypt the traffic.
SSL Handshake Message Types
The table below lists all SSL handshake message types that can be used as Wireshark display filters.
| Code | Description |
|---|---|
| 0 | HelloRequest |
| 1 | ClientHello |
| 2 | ServerHello |
| 4 | NewSessionTicket |
| 8 | EncryptedExtensions (TLS 1.3) |
| 11 | Certificate |
| 12 | ServerKeyExchange |
| 13 | CertificateRequest |
| 14 | ServerHelloDone |
| 15 | CertificateVerify |
| 16 | ClientKeyExchange |
| 20 | Finished |