How do I know which cipher suite is used?

How do I view cipher suites in Wireshark?

I have recently setup a network capture using Wireshark on a laptop and server.

This has been setup using OpenVPN. The connection is encrypted with the AES-256-CBC cipher. The encryption is negotiated using the Diffie-Hellman group size 2024. When I open up Wireshark, the network monitor doesn't show any details for the VPN tunnel or cipher settings. If you know how to view the cipher suites of a Wireshark capture please let me know. Which means it is not using the 'encrypt' option but rather 'tunnel mode' over 'openvpn', ie the packet data is actually being streamed from your (client) computer to the remote server over an encrypted network connection. It then appears that OpenVPN is simply encapsulating that connection in an IPsec (or IPSec as it is called now) tunnel, and sending it on its way. (As to your questions about 'why doesn't Wireshark show AES encryption', I suspect this is because that information is not in the traffic that Wireshark sees.)
If you are able to see other TCP or UDP traffic on the capture, then you should be able to do an edit capture including the IP traffic and look at the packets to see what cipher suite (if any) each one of them uses. It's probably that they use diffie-hellman 2024 but I don't have any of my Wireshark setups handy to test that with.

If you do not see any other traffic on the capture, the reason might be that, for some reason, the server is not sending data back to you.

Does Wireshark show ciphers?

From reading about the Wireshark crypto framework, I can see the AES-CBC cipher is used.

However, I can't find any indication that this particular cipher has been chosen by Wireshark. Does anyone know if Wireshark includes the cipher choice as a setting? And if not, how can I see which ciphers have been selected as a network capture? I realize this might be a bit of a dumb question, and I'm guessing there's a setting somewhere but I just can't find it.

Thanks! Wireshark has the crypto option to select the ciphers. You have to enable them though in the preferences. It looks like the default is to use 3DES. If you want to see which ones are enabled you can simply run wireshark in monitor mode on the interface with a capture file created from it. The list will show what ciphers are set for monitor mode.

What are the 2 types of filters used by Wireshark?

In the Wireshark, as shown in figure below, there are 2 types of filters used: # Type Filters.

# ------------. # Matching all protocols to capture all packets on that protocol (or port). Proto.addr == ether port == 4053 seq == 1025 # Matching specific MAC addresses (ie, those which match the MAC address of a specific interface). Mac.addr == 00:0c:29:0a:08:9a 168.1000100 and port number 66)
Icmp.type == EchoReply dontfragment ip.ihl == 5
The filtering types may help you for your question.