# Reading TLS packets from a capture file

**URL:** <https://discuss.elastic.co/t/reading-tls-packets-from-a-capture-file/198664>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 9, 2019, 10:58am UTC](https://discuss.elastic.co/t/reading-tls-packets-from-a-capture-file/198664 "2019-09-09T10:58:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stackoverflow](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@stackoverflow](https://discuss.elastic.co/u/stackoverflow)\
**Post date:** [September 9, 2019, 10:58am UTC](https://discuss.elastic.co/t/reading-tls-packets-from-a-capture-file/198664/1 "2019-09-09T10:58:12Z")

</div>

Hello,

I am interested in running packet beat with a -I option to parse TLS metadata stored in a file.  
I am only interested in Client Hello, Server Hello TLS messages.  
I would like to know if the capture file should have only the TLS packets which start with 16 03 03 or it needs to have complete TCP IP packets.  
The reason is I do not want to create and process big files.

Please let me know if there is any other way to only put the complete TLS packet and then run the Packetbeat like packetbeat.exe -e -c conf.yml -t -I .\a.log --d "publish"  
or if there is any other option.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2019, 10:58am UTC](https://discuss.elastic.co/t/reading-tls-packets-from-a-capture-file/198664/2 "2019-10-07T10:58:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.