SSL and TLS v2 are both supported protocols, but I cannot create a packet colorization rule to highlight either of these. Is there an update to fix this, or is it not possible? asked 17 Feb '16, 07:58  banjoguru |
One Answer:
If the question is about how to use a coloring rule that indicates whether an SSL Record is SSL3.0 vs. TLS (1.0 1.1 1.2) these filters might do what you're seeking (even if wireshark has not recognized the data as SSL) They will check whether the first data bytes after the TCP header (and after timestamp options if they exist) are x1403vv x1503vv x1603vv or x1703vv (tcp[12,21]==5003 && tcp[20]>13&&tcp[20]<18&& tcp[22]<1)||((tcp[12,33]==8003 && tcp[32]>13 && tcp[32]<18 && tcp[34]<1)) (tcp[12,21]==5003 && tcp[20]>13&&tcp[20]<18&& tcp[22]<4)||((tcp[12,33]==8003 && tcp[32]>13 && tcp[32]<18 && tcp[34]<4))
Hope this answers (part of) your question. Regards Matthias answered 20 Feb '16, 11:51  mrEEde |
How are you attempting to add colorization? What version are you using? I just tried adding a coloring rule for "ssl" and it worked just fine.