The value 22 (0x16 in hexadecimal) has been defined as being “Handshake” content.Īs a consequence, tcp & 0xf0) > 2)] = 0x16 captures every packet having the first byte after the TCP header set to 0x16. Look for the Protocols option on the left-hand pane, click it, and navigate to SSL. The first byte of a TLS packet define the content type. Open your Wireshark and go to Edit > Preferences. The offset, once multiplied by 4 gives the byte count of the TCP header, meaning ((tcp & 0xf0) > 2) provides the size of the TCP header. Many QUIC implementations have options for that or even use SSLKEYLOGFILE 2) You can take a look at. Tcp means capturing the 13th byte of the tcp packet, corresponding to first half being the offset, second half being reserved. 1) You might get the TLS keys from the server-side if youre in control of that yourself. Tcp & 0xf0) > 2)] = 0x16: a bit more tricky, let’s detail this below Tcp port 443: I suppose this is the port your server is listening on, change it if you need Tcpdump -ni eth0 “tcp port 443 and (tcp & 0xf0) > 2)] = 0x16)”Įth0: is my network interface, change it if you need

Wireshark use sslkey