How to detect TOR usage with Wireshark?

Question

I use TOR inside a Virtual Machine. I run Wireshark on my Host. I want to detect TOR usage (for learning/studying) with Wireshark but don't know how. I've tried this:

https://ask.wireshark.org/questions/13590/tor-detection

but tshark output doesn't show any cert names. Are there any other ways to accomplish this task?

Edit: reply to Kurt Knochner

This is what I did:

sudo wireshark

Then I choose wan0 interface and basically start live capturing. I use Tor on my Virtual Machine and after decent amount of time I save the log to file.pcapng

Next according to your method I do:

tshark -r file.pcapng -T fields -R "ssl.handshake.certificate" -e x509af.utcTime -e x509s

Output:

tshark: -R without -2 is deprecated. For single-pass filtering use -Y.
$

And that's it, no certificates found. I also converted file.pcapng to file.pcap and ran the command again without luck. What am I doing wrong?

Answer 1

but tshark output doesn't show any cert names. Are there any other ways to accomplish this task?

apparently it does work in my example, as shown in my answer to the question you mentioned.

So, you either did not capture SSL/TLS handshake traffic or there is a problem with the way you ran tshark. As you neither provided the tshark command nor the capture file, it's kind of hard/impossible to help you!

Please add the information I mentioned (tshark command, pcap file).

Regards
Kurt