On a device located between my local network and a router, (all the traffic pass through) I need to read the common name from Hello Server Certificate packet.So I'm trying to figure out how to get the proper filter with tcpdump.I found help from this paper : http://www.wains.be/pub/networking/tcpdump_advanced_filters.txtIt explains how to use advance filter on IP and TCP fields.I try this kind of filter :tcpdump -i any 'tcp and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -A -s 0 -v | grep 'Host\|id-at-commonName='As explained in the paper, We are matching any packet that contains data.It works for Host field as for many other data, but I can't match the field id-at-commonName= which is in SSL field (so in the TCP Data field ?).To be sure I captured a pcap file with the exact same filter (without the grep) and when I open it with Wireshark, I can read every Certificate Common name.I must use a tcpdump filter because I need to get the data on the fly.Can someone tell why I can't see those data through tcpdump ?
tcpdump hello server certificate
tcpdump