How to extract a list of server names of all SSL Handshakes present in log?

Question

Hi!

I have a pcap file with requests over SSL.

Under:

SSL
TLSv1.2 Record Layer: Handshake Protocol: Client Hello
Handshake Protocol: Client Hello
Extension: server_name
Server Name Indication extension
Server Name

I find the host name of the involved server.

I would like to extract all values of this type into a list.

Do I have to resort to a programmatic solution using an external library with Python f.x. or is there a built in feature which would allow me to accomplish that or something equivalent?

Kind Regards

Raffael

Accepted Answer

Use tshark from the command line, specificying that you only want the server name field, e.g.

tshark -r path\to\your\capture -T fields -e ssl.handshake.extensions_server_name -R ssl.handshake.extensions_server_name

Depending on your OS, you may need to provide the path to tshark and use "/" as the path separator.