22

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.

ip.proto == "TLSV1" says "ip.proto cannot accept strings as values"

Update - additional tips:

Another great but hidden search is on PacketLength: You can add packet length to your display by clicking "Edit Preferences" (menu or icon), and adding the PacketLength as a new column, but to filter on it you have to use the more cryptic: frame.len == ### where ### is your desired number. We were using this to determine how many packets had been sent and/or received, when you filter, the status-bar at the bottom of the screen shows the number of items matching the filter.

Improve this question

1 Answer 1

Reset to default
32

ssl.record.version == 0x0301

That tells Wireshark to only display packets that are SSL conversations using TLS semantics.

Improve this answer
7
  • Wow, thanks! Seems like one could filter on the words on the screen instead of the crypto codes.
    – NealWalters
    Dec 28, 2010 at 21:45
  • "ip.proto == 6"was somewhat close to what I wanted (but gives SMB and TCP as well as TLSV1)
    – NealWalters
    Dec 28, 2010 at 21:47
  • 2
    "ip.proto" refers to the "Protocol" field in the IP header: wireshark.org/docs/dfref/i/ip.html. "ip.proto == 6" means "Any TCP packet carried over IPv4". Most of Wireshark's display filters correspond to a numeric value in a given protocol header.
    – Gerald Combs
    Dec 29, 2010 at 0:39
  • 8
    FYI : Version Values dec hex ------------------------------------- SSL 3.0 3,0 0x0300 TLS 1.0 3,1 0x0301 TLS 1.1 3,2 0x0302 TLS 1.2 3,3 0x0303
    – Jay D
    Oct 19, 2015 at 23:50
  • 4
    I think this answer should really be ssl.handshake.version instead of ssl.record.version. There's a difference between the TLS Record and TLS Handshake layers
    – Unglued
    Feb 13, 2018 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.