NETMON Filters

(SSL or TLS) = Any TLS or SSL Traffic

TLS.TlsRecLayer.TlsRecordLayer.Version.Minor == 0x1 <–TLS1.0

TLS.TlsRecLayer.TlsRecordLayer.Version.Minor == 0x2 <– TLS1.1

TLS.TlsRecLayer.TlsRecordLayer.Version.Minor == 0x3 <– TLS1.2

Finding clients that use 3DES via the server hello :

TLS.TlsRecLayer.TlsRecordLayer.SSLHandshake.HandShake.ServerHello.TLSCipherSuite == 0xa

Filter for IP’s between ranges

ipv4.DestinationAddress>25.0.0.0 AND ipv4.DestinationAddress < 25.255.255.255