Suricata

Andreas, please see attached files. Please let me know if you need additional information.

Mats can you take a look into that?

What kind of logs are you looking for ?
eve.json ? tls.log ?

For both of these, they require a certificate to log something.
And this is not the case in this pcap as it is client side only.

I confirm that with --set stream.async-oneside=true the TLS app layer is indeed recognized and parsed

Code is in log-tlslog.c (and similar test in output-json-tls.c) :

    if (((hlog->flags & LOG_TLS_SESSION_RESUMPTION) == 0 ||
            (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) == 0) &&
            (ssl_state->server_connp.cert0_issuerdn == NULL ||
            ssl_state->server_connp.cert0_subject == NULL) &&
            ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
        return 0;
    }