is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the "Client Hello"? If yes, where can I find it?
BR and thanks in advance.
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Yes, absolutely, that is possible. The TLS record header is not encrypted. The two-octet version field is located at offset 1 in the TLS record header. Assuming a TLS record was not split into multiple TCP segments (which in practice is usually the case but cannot be relied upon), the second and third byte within the TCP payload indicate the TLS version used, e.g.
0x03 0x01 for TLS 1.0 or
0x03 0x03 for TLS 1.2. For more details, refer to the respective RFCs, e.g. RFC 5246 6.2.3 for the format of the TLS 1.2 record layer for encrypted payloads.
Wireshark and its command line companion
tshark will show you the decoded TLS version of any given TLS record as you would expect. To show that using
tcpdump, you can use
-x to get a hex dump and find offset 1 within the TCP data after removing the IP and TCP headers.