Which display filter selects TLS Server Hello messages?

• A. tls.handshake.type == 1
• B. tls.handshake.type == 2
• C. tls.handshake.type == 3
• D. tls.handshake.type == 0

Answer: (B)

TLS handshake messages include a numeric code that identifies the kind of message. The Server Hello, which the server sends in response to the client’s Client Hello, has the handshake type value 2. So using a filter that checks the handshake type for equality with 2 will display only Server Hello messages. This makes the filter precise for isolating that step in the TLS handshake.

Other values correspond to different handshake messages or, in some cases, aren’t used by TLS at all. For example, 1 would match the Client Hello, 0 is a less common HelloRequest, and 3 does not map to a standard TLS handshake type, so it wouldn’t capture Server Hello frames.