Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] malformed ssl packet

From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 13 Feb 2009 18:37:35 +0100
On Fri, Feb 13, 2009 at 01:14:48PM +0100, Toralf F�rster wrote:
> Hello,
> 
> I'm wondering why packet #17 is malformed in the attached stream, it looks 
> like a common error message.

It's a strange converstion, it starts with SSL, but after the client
sends some data and terminates the connection, the server comes back
with an SSH response in frame #15: SSH-2.0-DraySSH_2.0. Of course the
SSL dissector does not understand these bytes and marks them as
malformed (as the first bytes do not correspond to valid SSL record
layer version and length parameters).

Hope this helps,
Cheers,
     Sake