Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Possible change to packet-ssl.c?

From: Peter Wu <lekensteyn@xxxxxxxxx>
Date: Thu, 10 Apr 2014 10:17:57 +0200
On Wednesday 09 April 2014 16:49:43 Guy Harris wrote:
> Why is that treated as a "this is encrypted" indication rather than a
> "somebody's trying to extract whatever's in the server's memory after the
> request payload" indication?

After the handshake, the record layer is encrypted, including heartbeats.