is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the "Client Hello"? If yes, where can I find it?

BR and thanks in advance.

  • Not unless you saw the client-hello.
    – Ricky
    Jul 27, 2015 at 8:27

1 Answer 1


Yes, absolutely, that is possible. The TLS record header is not encrypted. The two-octet version field is located at offset 1 in the TLS record header. Assuming a TLS record was not split into multiple TCP segments (which in practice is usually the case but cannot be relied upon), the second and third byte within the TCP payload indicate the TLS version used, e.g. 0x03 0x01 for TLS 1.0 or 0x03 0x03 for TLS 1.2. For more details, refer to the respective RFCs, e.g. RFC 5246 6.2.3 for the format of the TLS 1.2 record layer for encrypted payloads.

Wireshark and its command line companion tshark will show you the decoded TLS version of any given TLS record as you would expect. To show that using tcpdump, you can use -x to get a hex dump and find offset 1 within the TCP data after removing the IP and TCP headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.