Which approach filters the capture to TLS handshake messages?

• A. Use a TLS/SSL filter such as tls and then inspect handshake-related messages
• B. Filter by http and then TLS handshake messages
• C. Filter by tcp.port == 443 only
• D. Use dns filter

Answer: (A)

TLS handshake messages are the set of messages that establish a secure session within the TLS protocol. To study them, start by filtering for TLS traffic so you only see TLS records, then zero in on the handshake messages themselves. In Wireshark, you can narrow further with a handshake-specific filter (for example, tls.handshake) to display only the handshake messages like ClientHello, ServerHello, Certificate, and so on. Filtering by HTTP won’t catch the TLS handshake, since the HTTP layer comes after the handshake, and filtering by a port like 443 is not precise to handshake content and can include other TLS records or miss nonstandard cases. DNS is unrelated to TLS handshakes. So, applying a TLS filter first and then inspecting the handshake messages is the direct, precise approach.