up vote 3 down vote favorite
1
share [g+] share [fb]

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.

ip.proto == "TLSV1" says "ip.proto cannot accept strings as values"

Update - additional tips:

Another great but hidden search is on PacketLength: You can add packet length to your display by clicking "Edit Preferences" (menu or icon), and adding the PacketLength as a new column, but to filter on it you have to use the more cryptic: frame.len == ### where ### is your desired number. We were using this to determine how many packets had been sent and/or received, when you filter, the status-bar at the bottom of the screen shows the number of items matching the filter.

link|improve this question
91% accept rate
feedback

1 Answer

up vote 4 down vote accepted

ssl.record.version == 0x0301

That tells Wireshark to only display packets that are SSL conversations using TLS semantics.

link|improve this answer
Wow, thanks! Seems like one could filter on the words on the screen instead of the crypto codes. – NealWalters Dec 28 '10 at 21:45
"ip.proto == 6"was somewhat close to what I wanted (but gives SMB and TCP as well as TLSV1) – NealWalters Dec 28 '10 at 21:47
1  
"ip.proto" refers to the "Protocol" field in the IP header: wireshark.org/docs/dfref/i/ip.html. "ip.proto == 6" means "Any TCP packet carried over IPv4". Most of Wireshark's display filters correspond to a numeric value in a given protocol header. – Gerald Combs Dec 29 '10 at 0:39
@Gerald is right. IP Protocol Number is nothing like TCP Port number, which is why it said "ip.proto cannot accept strings." en.wikipedia.org/wiki/List_of_IP_protocol_numbers – mfinni Dec 29 '10 at 1:02
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.