Wireshark-users: Re: [Wireshark-users] Interpreting TLS v1 Capture (Anti-Debug Trick?)

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 2 Jun 2009 22:53:03 +0200

On Tue, Jun 02, 2009 at 03:43:25PM -0400, Jeffrey Walton wrote:
> Second Socket (TLS v1):
> * TCP Three way handshake
> * Client Hello
> 
> After the client hello, Wireshark is claiming '[TCP Previous segment
> lost] [TCP segment of a reassembled PDU]'. I then observe a data
> exchange, but Wireshark reports 'Ignored unknown data'. No information
> regarding the server hello, and no 'vanilla' TCP data transfer.
>
> I suspect that this *might* be an anti-debug/trace trick (am I being
> too paranoid?). It is definitely reproducible. Has anyone encountered
> similar?

You might be a bit too paranoid here, but could you send in the
tracefile showing this behavior, as I...

> The server in question is instinfo.onecare-live.com.nsatc.net.

... can't seem to reproduce it here. The site just gives me a normal SSL
handshake in the proper order.

I think you just receive the frames out-of-order, or your capturing
device might miss a packet here and there...

Cheers,
    Sake