Which expression filters TLS Client Hello messages using the handshake_type field?

• A. tls.handshake.type == 2
• B. tls.handshake.type == 3
• C. tls.handshake.type == 0
• D. tls.handshake.type == 1

Answer: (D)

TLS messages in the handshake carry a HandshakeType that identifies the specific message, and ClientHello has the value 1. Using the filter tls.handshake.type == 1 selects exactly those handshake messages that are ClientHello, since the type field matches 1 only for ClientHello. Other handshake messages use different values (for example, HelloRequest is 0, ServerHello is 2), so they won’t match this filter. That makes this expression the correct way to filter for ClientHello messages.