drop a pcap file · extract tls session tickets from client hello extensions · link multiple tls connections to the same underlying session · de-anonymize traffic across apparent ip changes · detect session ticket reuse across different source ips · runs locally
pcap
drop pcap
or click
session ticket extension 0x0023 · TLS 1.3 PSK 0x0029 · SHA256 fingerprint only
drop pcap / pcapng with TLS client hellos