Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9875] SSL Hello Client

Date: Wed, 12 Mar 2014 17:49:59 +0000

changed bug 9875

What Removed Added
CC   [email protected]

Comment # 1 on bug 9875 from
I think it would help if you also attached an actual pcap capture file. You
don't need to attach the whole original pcap file: instead, just export the
packets you want, by going to menu File->Export Specific Packets... You can
then put the packet numbers you want to export into the "Specify a packet
range" box; alternatively, first mark the packets you want (right click on them
and select "Mark Packet", and then go to the Export Specified Packets dialog
and choose "Marked Packets".

Either way, the point is you can create a new pcap capture file with just the
relevant packets, and attach it to this bug.

But note that your trace shows these Hello messages as coming from reassembled
TCP segments in separate frames/packets, so you need to save those
frames/packets too in your pcap file:
    [Frame: 50021, payload: 0-1367 (1368 bytes)]
    [Frame: 50022, payload: 1368-2735 (1368 bytes)]
    [Frame: 50025, payload: 2736-4103 (1368 bytes)]
    [Frame: 50027, payload: 4104-5471 (1368 bytes)]
    [Frame: 50029, payload: 5472-5895 (424 bytes)]

So to make it easier/safe, just export using this range:
50010-50040,51340-51370,63120-63140


You are receiving this mail because:
  • You are watching all bug changes.