Filtering on ServerHello TLS 1.0 negotations RRS feed

  • Question

  • Hi Everyone,

    What am I doing wrong using the following filter. I'm trying to find all client hellos with "registration" that are negotiating a TLS 1.0 ServerHello


    ContainsBin(FrameData, ASCII, "registration") and tls.TlsRecLayer.TlsRecordLayer.SSLHandshake.HandShake.ServerHello.Version.Minor == 0x1

    Nothing is returned despite there being plenty of clienthello with "registration"


    Thursday, September 5, 2019 2:30 AM

All replies