Wireshark-users: [Wireshark-users] tshark reassembled TLSv1 record: Can it display certificate at
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Magnuson, Steve" <Steve.Magnuson2@xxxxxxxxxx>
Date: Fri, 18 Dec 2009 15:00:32 -0800
Is there a way to tell tshark to display, for example, x509sat.printableString and x509af.utcTime attributes for each certificate in a certificate chain?  This command will only show the attributes for the first certificate in a certificate chain in a reassembled TLSv1 record:

tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e x509sat.printableString -e x509af.utcTime

In Wireshark, it shows the reassembled certificate chain and you can look at attributes for each certificate, but tshark only shows the attributes for the first certificate - unless I'm missing something.

Thanks,

Steve