Sample Header Ad - 728x90

How to extract domains related to "Client Hello" in a pcap file

1 vote
1 answer
1323 views
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command: strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' | sort -u > out But I want to extract only those related to the string "Client Hello". Example in Wireshark: Handshake Protocol: Client Hello Server Name: example.com Is there any way of doing this?
Asked by acgbox (1010 rep)
Jul 9, 2020, 10:25 PM
Last activity: Jul 10, 2020, 05:12 PM