Setting up a tcpdump filter

WIRESHARK <-> TCPDUMP

(ip.src == 192.102.67.73) <-> (src host 192.102.67.73)

(tcp.srcport == 443 <-> (src port 443)

(tcp.flags == 0x018) <-> (tcp[13] == 24)

(ssl.record.content_type == 22) <-> (tcp[((tcp[12] & 0xf0) >> 2)] = 0x16)

(ssl.handshake.type == 2) <-> (tcp[((tcp[12] & 0xf0) >> 2)+5] = 0x02)

You cannot create the last line in tcpdump. Take into account tcpdump uses a deterministic matching. To do the last, you should use post-processing (scripting).

I would appreciate if you rate my answer.

KR,

Dario.