Skip to main content

handshakes_from_pcap

flowscope::tls

Function handshakes_from_pcap 

Source 
pub fn handshakes_from_pcap<P: AsRef<Path>>(
    path: P,
) -> Result<impl Iterator<Item = (FiveTupleKey, TlsHandshake)>>
Available on crate features pcap and tls only.
Expand description

Iterate every aggregated TlsHandshake in the pcap, paired with the FiveTupleKey of the flow it was seen on. One event per handshake (ClientHello + ServerHello + outcome rolled into a single value), rather than one per TLS record.

for (key, hs) in flowscope::tls::handshakes_from_pcap("trace.pcap")? {
    println!("{key:?}  sni={:?} ja4={:?} outcome={:?}", hs.sni, hs.ja4, hs.outcome);
}