Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.

ip.proto == "TLSV1" says "ip.proto cannot accept strings as values"

Update - additional tips:

Another great but hidden search is on PacketLength: You can add packet length to your display by clicking "Edit Preferences" (menu or icon), and adding the PacketLength as a new column, but to filter on it you have to use the more cryptic: frame.len == ### where ### is your desired number. We were using this to determine how many packets had been sent and/or received, when you filter, the status-bar at the bottom of the screen shows the number of items matching the filter.

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

ssl.record.version == 0x0301

That tells Wireshark to only display packets that are SSL conversations using TLS semantics.

share|improve this answer
Wow, thanks! Seems like one could filter on the words on the screen instead of the crypto codes. –  NealWalters Dec 28 '10 at 21:45
"ip.proto == 6"was somewhat close to what I wanted (but gives SMB and TCP as well as TLSV1) –  NealWalters Dec 28 '10 at 21:47
"ip.proto" refers to the "Protocol" field in the IP header: wireshark.org/docs/dfref/i/ip.html. "ip.proto == 6" means "Any TCP packet carried over IPv4". Most of Wireshark's display filters correspond to a numeric value in a given protocol header. –  Gerald Combs Dec 29 '10 at 0:39
@Gerald is right. IP Protocol Number is nothing like TCP Port number, which is why it said "ip.proto cannot accept strings." en.wikipedia.org/wiki/List_of_IP_protocol_numbers –  mfinni Dec 29 '10 at 1:02
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.