title: How to extract an SSL/TLS message using scapy and python?
body: <p>I'm trying to read a TLS message. Specifically, the one with the certificate details (handshake_type = 11). What I'm doing is first checking that the message contains <code>Raw</code>. If so, I'm extracting the payload like so: <code>b = bytes(pkt[Raw].load)</code>. Next, I'm checking that <em>the first</em> byte is <code>0x16</code> and the following two bytes need to be a proper TLS version.</p>
  
  <p>The problem is that this message doesn't pass these conditions. WireShark is showing me that <code>\x16\x03\x03</code> are the bytes at position <code>0000</code> (picture is attached), but I guess it is done for convenience.</p>
  
  <p>So is my assumption that the payload MUST start with <code>0x16</code> wrong?</p>
  
  <p>P.S<br>
  I don't want to use <code>scapy-ssl_tls</code> library.</p>
  
  <p><a href="https://i.stack.imgur.com/eAyYT.png" rel="noreferrer"><img src="https://i.stack.imgur.com/eAyYT.png" alt="enter image description here"></a></p>
  
  <p><strong>EDIT</strong><br>
  This is the code:</p>
  
  <pre><code>def handle_tls_packet(pkt):
      if pkt.haslayer(Raw):
          b = bytes(pkt[Raw].load)
  
          if b[0] == 0x16:
              version =  int.from_bytes(b[1:3], 'big')
              message_len = int.from_bytes(b[3:5], 'big')
              handshake_type = b[5]
              handshake_length = int.from_bytes(b[6:9], 'big')
  
              print("v = ", version, " len = ", message_len, " htype =", handshake_type
              , "hlen =", handshake_length)
  
              if handshake_type == 11:
                  # never happens - Why?
                  certs_len = int.from_bytes(b[7:11], 'big')
  </code></pre>
  
  <p><strong>EDIT2:</strong><br>
  As suggested by <strong>Cukic0d</strong>, I used <code>load_layer("ssl")</code>.</p>
  
  <p>Apparently, <code>pkt[TLS].msg</code> is a list (to hold multiple TLS messages in one packet?). Anyways, I printed the type of every such message like so:</p>
  
  <pre><code>def handle_tls_packet(pkt):
      for tls_msg in pkt[TLS].msg:
          print(type(tls_msg))
  </code></pre>
  
  <p>I expected to see a <code>TLSCertificate</code> object, yet such object is never seen.
  Why?</p>
  
  <p><strong>EDIT3:</strong><br>
  I'm willing to use <code>scapy-ssl_tls</code> if that would make life easier.</p>