Which expression filters TLS Server Hello messages using the handshake_type field?

• A. tls.handshake.type == 1
• B. tls.handshake.type == 3
• C. tls.handshake.type == 0
• D. tls.handshake.type == 2

Answer: (D)

TLS handshake messages include a type field that identifies what kind of message it is. The ServerHello message is assigned the value 2, so filtering with tls.handshake.type == 2 selects only those ServerHello frames. The other numbers correspond to different handshake messages (for example, ClientHello is 1, HelloRequest is 0), so they wouldn’t match ServerHello.