Which filter shows TLS handshake messages in Wireshark?

• A. http.request
• B. arp
• C. dns.query
• D. tls or ssl

Answer: (D)

The filter for TLS (and its older alias SSL) is the one you want because the TLS handshake is part of the TLS protocol. Using this filter isolates all TLS traffic, including the handshake messages such as ClientHello, ServerHello, and Certificate exchanges, which occur before any application data is sent. Other filters target different protocols (HTTP, ARP, DNS) and won't show the TLS handshake because those protocols aren’t involved in the initial TLS negotiation. In Wireshark, you’ll see TLS handshake details under the TLS dissector (e.g., “Handshake Protocol: ClientHello”) once you apply the filter. The TLS filter is the most direct way to view these handshake messages.