Which display filter selects TLS Client Hello messages?

• A. tls.handshake.type == 1
• B. tls.handshake.type == 2
• C. tls.handshake.type == 3
• D. tls.record.version

Answer: (A)

The filter uses the TLS handshake message type field, which identifies which handshake message is being carried. The ClientHello is the first message sent by the client to start negotiations, and its handshake type value is 1. So tls.handshake.type == 1 selects exactly those ClientHello messages, filtering out other handshake messages like ServerHello or Certificate. Filtering by tls.record.version would zoom in on the protocol version (like TLS 1.2 or 1.3) rather than the message type, so it wouldn’t isolate ClientHello.