Lion Cipher Lab
Watch a TLS 1.3 handshake happen in Wireshark
- Foundations
- Intermediate
- ~40 min
- Free · no account required
Why it matters
After the TCP three-way handshake you already watched, the very next thing your browser does before loading any page is negotiate encryption with the TLS handshake. Almost everyone treats HTTPS as a black box — 'there's a padlock, so it's private' — and that belief is only half true. Seeing a real TLS 1.3 handshake teaches you exactly where the privacy line is: what a passive observer on your network still learns even when they can't read your data (which site you visited, from the SNI; the destination IP; the sizes and timing of everything), and what genuinely is hidden. It is a staple…
What you'll learn
- reading a TLS 1.3 handshake in Wireshark
- dissecting the Client Hello (SNI, cipher suites, supported_versions, key_share, GREASE)
- understanding the TLS 1.3 legacy-version quirk (0x0303 vs 0x0304)
- knowing what TLS 1.3 encrypts after the Server Hello
- decrypting captured TLS with SSLKEYLOGFILE
- judging what a network observer can and cannot see under TLS
Steps in this lab
- Where TLS sits — one layer above the handshake you already watched
- Capture your own HTTPS traffic
- Open the Client Hello — the one part sent in the clear
- Don't be fooled by the '1.2' label — the TLS 1.3 version quirk
- Find the Server Hello — and watch the rest go dark
- Decrypt it with SSLKEYLOGFILE — the payoff
- What TLS still leaks — the judgment that matters
- If you saw no TLS, or couldn't decrypt — the quick fixes