22

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.

ip.proto == "TLSV1" says "ip.proto cannot accept strings as values"

Update - additional tips:

Another great but hidden search is on PacketLength: You can add packet length to your display by clicking "Edit Preferences" (menu or icon), and adding the PacketLength as a new column, but to filter on it you have to use the more cryptic: frame.len == ### where ### is your desired number. We were using this to determine how many packets had been sent and/or received, when you filter, the status-bar at the bottom of the screen shows the number of items matching the filter.

Improve this question

1 Answer 1

Reset to default
32

ssl.record.version == 0x0301

That tells Wireshark to only display packets that are SSL conversations using TLS semantics.

Improve this answer
7
  • Wow, thanks! Seems like one could filter on the words on the screen instead of the crypto codes.
    – NealWalters
    Commented Dec 28, 2010 at 21:45
  • "ip.proto == 6"was somewhat close to what I wanted (but gives SMB and TCP as well as TLSV1)
    – NealWalters
    Commented Dec 28, 2010 at 21:47
  • 2
    "ip.proto" refers to the "Protocol" field in the IP header: wireshark.org/docs/dfref/i/ip.html. "ip.proto == 6" means "Any TCP packet carried over IPv4". Most of Wireshark's display filters correspond to a numeric value in a given protocol header.
    – Gerald Combs
    Commented Dec 29, 2010 at 0:39
  • 8
    FYI : Version Values dec hex ------------------------------------- SSL 3.0 3,0 0x0300 TLS 1.0 3,1 0x0301 TLS 1.1 3,2 0x0302 TLS 1.2 3,3 0x0303
    – Jay D
    Commented Oct 19, 2015 at 23:50
  • 4
    I think this answer should really be ssl.handshake.version instead of ssl.record.version. There's a difference between the TLS Record and TLS Handshake layers
    – Unglued
    Commented Feb 13, 2018 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .