Security · 58 tools · nothing uploads

TLS record parser

Decode a raw TLS record (RFC 8446 §5.1): content type, version, length, and for a ClientHello/ServerHello, the cipher suites/extensions inside. Give it bytes captured off the wire, not a PEM.

Input

TLS record parser decodes raw record bytes into the content type and record version, adding a hello's own version, session id size, cipher suites, compression methods and extension list. Reserved GREASE values are marked where they appear, and 14 extension types are named rather than numbered. Only the leading record is parsed, so anything captured after it is ignored.

Questions

What kind of input does it want?

Raw TLS record bytes captured off the wire, as described by RFC 8446 section 5.1. Not a PEM file, not a certificate, not a pcap. If you have a hex dump of the record, turn it into bytes with the From hexdump tool first.

What does it report?

The content type with its name, the record version, and for handshake records the handshake type. If the record carries a ClientHello or ServerHello it goes further: hello version, session id length, cipher suites, compression methods and extensions, with 14 common extension types named.

What are the GREASE markers next to some values?

They flag the reserved values from RFC 8701, whose two byte halves are equal, sent deliberately to check that implementations ignore values they do not know. They are marked in cipher suite and extension lists so you can tell a real negotiation entry from a probe.

Does it decrypt anything?

No. Only the handshake parts that travel in the clear are readable, which is what this parses. Application data records are reported as a content type, a version and a length, nothing more, because their contents are encrypted under keys this tool does not have and would not ask you for.

Why did I get a truncated error?

Because a length field pointed past the end of the bytes you gave. The message names how many more bytes were needed, at which offset, and how many were left, which usually means the capture was cut short or you pasted only part of the record. It also parses only the first record in the file, so extra records after it are ignored.

Related Security tools

·→1Subnet / CIDR calculatorCompute network address, broadcast/last address and host count for an IPv4 or IPv6 CIDR block. Pure arithmetic on the address you give it. No lookup, no network.Takes no file·→1IP range parserParse an IPv4/IPv6 range ("start-end" or CIDR) into its address count and the minimal set of CIDR blocks that cover it exactly. Pure arithmetic, no lookup.Takes no file·→1IPv4/IPv6 format convertShow one IP address in every common representation (dotted/expanded, integer, and hex), computed locally.Takes no file·→1IPv6 transition addressesBuild IPv4-mapped/6to4/NAT64 IPv6 forms from an IPv4 address, or decode an IPv6 address back to its embedded IPv4 (and, for Teredo, server/client/port/flags). Reports what pattern was recognised, not whether the address is reachable or in use.Takes no filen→nIPv4 / TCP / UDP header parserDecode an IPv4 header, then its TCP or UDP header if the protocol field says so (checksum verified against the standard Internet checksum, not TCP/UDP's, which need a pseudo-header this tool is not given the source context to build). Give it bytes starting at the IP header, e.g. an Ethernet frame's payload.Runs on each file you dropn→nEthernet frame parserDecode an Ethernet II frame: destination/source MAC, EtherType (unwrapping one 802.1Q VLAN tag if present), and payload length. IEEE 802.3 LLC/SNAP framing is not handled, only Ethernet II.Runs on each file you drop·→1MAC address formatterReformat a MAC address between colon, dash, Cisco dot-quad and bare-hex notation, and report the multicast/locally-administered bits.Takes no file·→1MAC / OUI vendor lookupLook up a MAC address's OUI against a small bundled table of 16 well-known prefixes, not the IEEE registry (2.9M+ entries, updated continuously, no offline way to bundle it here). "Not in bundled list" means exactly that, not "no vendor exists."Takes no file