<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Cryptographic Protocol Analysis

## tshark (Wireshark CLI)

### Synopsis

```bash
tshark -r <capture.pcap> -Y <display-filter> -T fields -e <field> [...]
tshark -i <interface> -f <capture-filter> -Y <display-filter>
```

### TLS Display Filters

| Filter | Description |
|---|---|
| `tls.handshake` | All TLS handshake messages |
| `tls.handshake.type == 1` | ClientHello only |
| `tls.handshake.type == 2` | ServerHello only |
| `tls.handshake.version < 0x0303` | Pre-TLS 1.2 handshakes |
| `tls.handshake.ciphersuite` | Negotiated cipher suite |

### Kerberos Display Filters

| Filter | Description |
|---|---|
| `kerberos` | All Kerberos traffic |
| `kerberos.etype == 23` | RC4-HMAC (weak) |
| `kerberos.etype == 18` | AES256-CTS (strong) |
| `kerberos.msg_type == 11` | AS-REP messages |

## ssh-audit

### Synopsis

```bash
ssh-audit [options] <host[:port]>
```

### Key Options

| Option | Description |
|---|---|
| `-j` | JSON output |
| `-l warn` | Show warnings and above |
| `-p <port>` | SSH port |
| `--client-audit` | Audit SSH client config |

## openssl s_client Version Testing

| Flag | Description |
|---|---|
| `-tls1` | Force TLS 1.0 |
| `-tls1_1` | Force TLS 1.1 |
| `-tls1_2` | Force TLS 1.2 |
| `-tls1_3` | Force TLS 1.3 |
| `-brief` | Brief connection summary |
| `-cipher <suite>` | Force specific cipher |

## Agent Script

```bash
# Analyze TLS configuration
node agent.js tls example.com

# Audit SSH server
node agent.js ssh example.com -p 22

# Analyze TLS in PCAP
node agent.js pcap capture.pcap --protocol tls

# Check for weak Kerberos encryption
node agent.js kerberos-weak capture.pcap
```
