clienthello

capture ClientHello from the wire or a pcap

❯ ./clienthello -text -pcap ~/VPNLab/clientHello/vpn-handshake-good.pcapng
00000000  16 03 01 00 e8 01 00 00  e4 03 03 af 30 db f1 df  |............0...|
00000010  6c 07 7b c2 54 e3 c2 f3  6a b5 db 20 02 b9 36 73  |l.{.T...j.. ..6s|
00000020  a8 a8 39 26 e9 dd 68 b6  58 c6 ef 20 1c 27 12 f9  |..9&..h.X.. .'..|
00000030  4e 76 64 38 8e 97 92 50  33 f9 1d 33 b1 39 47 c4  |Nvd8...P3..3.9G.|
00000040  2f cd a9 1c a4 98 b8 77  7c 07 3c 6d 00 0a 13 02  |/......w|.<m....|
00000050  13 03 13 01 c0 2c 00 ff  01 00 00 91 00 0b 00 04  |.....,..........|
00000060  03 00 01 02 00 0a 00 16  00 14 00 1d 00 17 00 1e  |................|
00000070  00 19 00 18 01 00 01 01  01 02 01 03 01 04 00 16  |................|
00000080  00 00 00 17 00 00 00 0d  00 2a 00 28 04 03 05 03  |.........*.(....|
00000090  06 03 08 07 08 08 08 09  08 0a 08 0b 08 04 08 05  |................|
000000a0  08 06 04 01 05 01 06 01  03 03 03 01 03 02 04 02  |................|
000000b0  05 02 06 02 00 2b 00 05  04 03 04 03 03 00 2d 00  |.....+........-.|
000000c0  02 01 01 00 33 00 26 00  24 00 1d 00 20 28 f8 a1  |....3.&.$... (..|
000000d0  8b ac 4f b7 fc 17 43 c3  60 df 83 f6 a4 52 3b 39  |..O...C.`....R;9|
000000e0  32 82 dc c6 82 87 d1 cb  43 3c de d4 1c           |2.......C<...|


raw:

16030100e8010000e40303af30dbf1df6c077bc254e3c2f36ab5db2002b93673a8a83926e9dd68b658c6ef201c2712f94e7664388e97925033f91d33b13947c42fcda91ca498b8777c073c6d000a130213031301c02c00ff01000091000b000403000102000a00160014001d0017001e00190018010001010102010301040016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d002028f8a18bac4fb7fc1743c360df83f6a4523b393282dcc68287d1cb433cded41c

Client Hello
  Version:       TLS 1.2
  Random:        2939214833:df6c077bc254e3c2f36ab5db2002b93673a8a83926e9dd68b658c6ef
  SessionID:     1c2712f94e7664388e97925033f91d33b13947c42fcda91ca498b8777c073c6d
  Cipher Suites:  (5 suites)
                        TLS_AES_256_GCM_SHA384 (1302)
                        TLS_CHACHA20_POLY1305_SHA256 (1303)
                        TLS_AES_128_GCM_SHA256 (1301)
                        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (c02c)
                        TLS_EMPTY_RENEGOTIATION_INFO_SCSV (ff)
  Compression:   null
  Extensions:
                        &{[0 1 2]}
                        &{[29 23 30 25 24 256 257 258 259 260]}
                        &{[]}
                        &{[]}
                        &{[1027 1283 1539 2055 2056 2057 2058 2059 2052 2053 2054 1025 1281 1537 771 769 770 1026 1282 1538]}
                        &{43 [4 3 4 3 3]}
                        &{45 [1 1]}
                        &{51 [0 36 0 29 0 32 40 248 161 139 172 79 183 252 23 67 195 96 223 131 246 164 82 59 57 50 130 220 198 130 135 209 203 67 60 222 212 28]}
captured 1 clientHellos