How can I obtain the name of the TLS fingerprint algorithm with tcpdump and tshark?

510 Views Asked by At

I have a web service and I want to get the tls fingerprint from the client hello package requested by the client. What should I do

I have tried using nginx-ssl-fingerprint(https://github.com/phuslu/nginx-ssl-fingerprint), which can work, but can only obtain TLSVersion, Ciphers, and cannot obtain TLS fingerprint extensions, EllipticCurves, EllipticCurvePointFormats.

enter image description here

According to the above image I have tried using tcpdump to listen to my server network card, then exporting the PCAP package and outputting it with tshark

But it can only print specific algorithm numbers. I actually want to obtain the name of the tls fingerprint algorithm, but the extensions, EllipticCurves, and EllipticCurvePointFormats cannot be obtained because using the tshark command results in an empty result

Command Prompt enter image description here

The main tshark cannot be obtained, but it can be obtained using wireshark. I am a bit confused and would like to know which commands are used to obtain these algorithms in the tshark command

like this:

enter image description here

I'm trying to read the OpenSSL documentation, to be honest, it's a bit obscure and difficult to understand.

Of course, if there were a better way, I would humbly seek advice

0

There are 0 best solutions below