title: C program to extract TLS record layer
body: <p>I am trying to parse a pcap to get the packet bytes of only the TLS Record Layer in the payload.
  In my following code I have managed to get only the tcp protocol bytes from the payload which contains the TLS Record Layer. I want to further extract only the TLS Record Layer bytes from this.
  Could you tell me how I can modify my code to extract only that part of the payload?</p>
  <pre><code>void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet){
      static int count = 1;                   /* packet counter */
  
      /* declare pointers to packet headers */
      const struct ether_header *ethernet;  /* The ethernet header [1] */
      const struct ip *ip;              /* The IP header */
      const struct tcphdr *tcp;            /* The TCP header */
  
      const struct sniff_udp *udp;        /* The UDP header */
      const char *payload;                    /* Packet payload */
  
      int size_ip;
      int size_tcp;
      int size_udp;
      int size_payload;
  
      printf(&quot;\nPacket number %d:\n&quot;, count);
      count++;
  
      /* define ethernet header */
      
  
      ethernet = (struct ether_header*)(packet);
      /* define/compute ip header offset */
  
  
      ip = (struct ip*)(packet + sizeof(struct ether_header));
  
      
      size_ip = sizeof(struct ip);
      if (size_ip &lt; 20) {
          //printf(&quot;   * Invalid IP header length: %u bytes\n&quot;, size_ip);
          return;
      }
  
      /* print source and destination IP addresses */
      printf(&quot;       From: %s\n&quot;, inet_ntoa(ip-&gt;ip_src));
      printf(&quot;         To: %s\n&quot;, inet_ntoa(ip-&gt;ip_dst));
  
      /* determine protocol */
      switch(ip-&gt;ip_p) {
          case IPPROTO_TCP:
              printf(&quot;   Protocol: TCP\n&quot;);
              break;
          case IPPROTO_UDP:
              printf(&quot;   Protocol: UDP\n&quot;);
              break;
          case IPPROTO_ICMP:
              printf(&quot;   Protocol: ICMP\n&quot;);
              return;
          case IPPROTO_IP:
              printf(&quot;   Protocol: IP\n&quot;);
              return;
          default:
              printf(&quot;   Protocol: unknown\n&quot;);
              return;
       }
  
      /*
       *  OK, this packet is TCP.
       */
  
      /* define/compute tcp header offset */
      if(ip-&gt;ip_p == IPPROTO_TCP)
      {
          
          tcp = (struct tcphdr *)(packet + sizeof(struct ether_header) + sizeof(struct ip));
          
          size_tcp = sizeof(struct tcphdr);
  
          
  
          printf(&quot;   Src port: %d\n&quot;, ntohs(tcp-&gt;th_sport));
          printf(&quot;   Dst port: %d\n&quot;, ntohs(tcp-&gt;th_dport));
          int sport = ntohs(tcp-&gt;th_sport);
          int dport = ntohs(tcp-&gt;th_dport);
  
          /* define/compute tcp payload (segment) offset */
          
  
          payload = (u_char *)(packet + sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
  
          /* compute tcp payload (segment) size */
          
  
          size_payload = header-&gt;len - (sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
          /*
           * Print payload data; it might be binary, so don't just
           * treat it as a string.
           */
          if (size_payload &gt; 0) {
              printf(&quot;   Payload (%d bytes):\n&quot;, size_payload);
              print_payload(payload, size_payload);
  
        //if ((sport == 80) || (dport == 80))
              //{
                  // printf(&quot;   HTTP prase:\n&quot;);
                  // prase_http(payload, size_payload);
              //}
              if(sport == 443 || dport == 443)
              {
                  // printf(&quot;   SSL/TLS prase:\n&quot;);
                  //prase_ssl_tls(payload, size_payload);
            //printf(&quot;%u&quot;,payload);
           // print_payload(payload, size_payload);
            parser(payload,size_payload);
  
              }
          }
      }
  
      /* UDP */
      else if(ip-&gt;ip_p == IPPROTO_UDP)
      {
          udp = (struct sniff_udp*)(packet + SIZE_ETHERNET + size_ip);
          size_udp = 8;
          printf(&quot;   Src port: %d\n&quot;, ntohs(udp-&gt;uh_sport));
          printf(&quot;   Dst port: %d\n&quot;, ntohs(udp-&gt;uh_dport));
          int sport = ntohs(udp-&gt;uh_sport);
          int dport = ntohs(udp-&gt;uh_dport);
  
          payload = (u_char *)(packet + SIZE_ETHERNET + size_ip + size_udp);
  
          size_payload = ntohs(ip-&gt;ip_len) - (size_ip + size_udp);
  
          if (size_payload &gt; 0) {
              //printf(&quot;   Payload (%d bytes:)\n&quot;, size_payload);
  
              if(sport == 53 || dport == 53)
              {
                  // printf(&quot;   DNS prase:\n&quot;);
                  // prase_dns(payload, size_payload);
              }
          }
      }
  return;
  }
  </code></pre>
  <p>This is the got_packet function passed as argument to pcap_loop which is part of &lt;pcap.h&gt; .All reference structures are used from
  &lt;arpa/inet.h&gt;,&lt;net/ethernet.h&gt;,&lt;netinet/ip.h&gt;,&lt;netinet/tcp.h&gt;</p>
  <p>I am looking to extract this part of the packet(image link attached):
  <a href="https://i.stack.imgur.com/kYZKW.png" rel="nofollow noreferrer">Screenshot from wireshark as to what I wish to parse</a></p>
  <p>Could someone help me with this?</p>