is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the "Client Hello"? If yes, where can I find it?
BR and thanks in advance.
-
Not unless you saw the client-hello.– RickyCommented Jul 27, 2015 at 8:27
Add a comment
|
1 Answer
Yes, absolutely, that is possible. The TLS record header is not encrypted. The two-octet version field is located at offset 1 in the TLS record header. Assuming a TLS record was not split into multiple TCP segments (which in practice is usually the case but cannot be relied upon), the second and third byte within the TCP payload indicate the TLS version used, e.g. 0x03 0x01 for TLS 1.0 or 0x03 0x03 for TLS 1.2. For more details, refer to the respective RFCs, e.g. RFC 5246 6.2.3 for the format of the TLS 1.2 record layer for encrypted payloads.
Wireshark and its command line companion tshark will show you the decoded TLS version of any given TLS record as you would expect. To show that using tcpdump, you can use -x to get a hex dump and find offset 1 within the TCP data after removing the IP and TCP headers.
