How to extract domains related to "Client Hello" in a pcap file
1
vote
1
answer
1323
views
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command:
strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' | sort -u > out
But I want to extract only those related to the string "Client Hello". Example in Wireshark:
Handshake Protocol: Client Hello
Server Name: example.com
Is there any way of doing this?
Asked by acgbox
(1010 rep)
Jul 9, 2020, 10:25 PM
Last activity: Jul 10, 2020, 05:12 PM
Last activity: Jul 10, 2020, 05:12 PM