Answer by Lekensteyn for Hello,I have a long-term capture taken on a server which at the moment is set-up to accept several versions of TLS, 1.1, 1,2 and older ones from outdated clients. The clients are connecting to the server using diferent protocols and ports, 443, 4343, 3389, 22 (HTTPS, RDP, SSH, FTPS mainly) and I try to indentify which versions of TLS are those clients using and which level of encryption. I have used "ssl.record.version" for each trace on the graphical interface, but as number of traces files increases,(~162 files, ~28 Gb of traces), I would like to use tshark to read the capture files and to be able to display those packets which contain TLS handshake, indepently of the protocol, or port. I think I have done it, using -r and -Y, but it's strange to me that when displaying on the screen I see the packet flows with different TLS versionstshark -r LANInterfaceServer104.pcapng -Y ssl.record.version 8222 ------ TLSv1 571 Client Hello26953 ------- TLSv1.2 437 Certificate, Server Key Exchange, Server Hello Done38554 -------- TLSv1.3 1414 Server Hello, Change Cipher Specbut then saving to a file, it has something different, I only find one TLS version, not all the packets are saved, and only those are in the new trace file created.tshark -r LANInterfaceServer104.pcapng -Y ssl.record.version -w TracewithTLS_versions.pcapngI wonder if this could be just because of the packets beloging to only one handshake are saved, or my filter commands are not properly correct. and additional question, I have also used TraceWrangler to scan, filter and extract the traces by ports, but I wonder if could be an option to implement a filter to extract any TLS handshake version as well and creating the file. I see the advantage of having such information in just one file, in order to identify the client IP, and application which have to be "corrected"Thanks in advanced.

TLS negotiates the TLS version during the handshake. The client reports its minimum version through the `tls.record.version` field and the server agrees to it in the Server Hello. If you would like to understand what versions are in use, it suffices to extract TLS Server Hello handshake messages using the filter: tls.handshake.type==2 Then inspect the Server Hello version field: tls.handshake.version or for TLS 1.3: tls.handshake.extensions.supported_version For example, to extract both version fields for Server Hello messages, it will show something like ` 0x00000303` (for TLS 1.2) or `0x00000304 0x00000303` (for TLS 1.3): tshark -r your.pcapng -T fields -Y tls.handshake.type==2 -e tls.handshake.extensions.supported_version -e tls.handshake.version Alternatively you can dump the Protocol column like this, it will show something like `TLSv1.2` or `TLSv1.3`: tshark -r your.pcapng -T fields -Y tls.handshake.type==2 -e _ws.col.Protocol For more details on the version negotiation, including TLS 1.3 considerations, see [this answer](https://ask.wireshark.org/question/5046/suspicious-activity-tls-mismatch-errors-browser-set-to-tls-v13-seeing-v10-on-ssllabs/?answer=5110#post-id-5110).