Ensuring Exclusion of Weak Ciphers in TLS Handshake using WireShark and PktMon

Question

I am currently working on enhancing the security of our application communication, specifically focusing on the TLS handshake process. I want to make sure that weak ciphers are not part of the TLS handshake, and I am trying to achieve this using WireShark and the PktMon tool on Windows. I have removed the TLS 1.0 and 1.1 and disabled weak ciphers in TLS 1.2. (In Windows)

I have configured my server (Cloud) to use only strong ciphers, but I would like to validate this by inspecting the TLS handshake packets with WireShark and PktMon. However, I am unsure about the specific steps and filters I need to apply to effectively identify and confirm the exclusion of weak ciphers during the TLS handshake.

Need to know how to use WireShark and PktMon to inspect TLS handshake packets and ensure that weak ciphers are not being utilized? Additionally, if there are specific filters or settings within WireShark or PktMon that I should be aware of to highlight or filter out weak ciphers, that information would be greatly appreciated.

Answer 1

Hello Deepak.

Take a look at the article at https://blog.devgenius.io/deep-dive-into-tls-ssl-handshake-using-wireshark-5abfe83560ce.

Bye.