On Tue, Jun 02, 2009 at 03:43:25PM -0400, Jeffrey Walton wrote:
> Second Socket (TLS v1):
> * TCP Three way handshake
> * Client Hello
>
> After the client hello, Wireshark is claiming '[TCP Previous segment
> lost] [TCP segment of a reassembled PDU]'. I then observe a data
> exchange, but Wireshark reports 'Ignored unknown data'. No information
> regarding the server hello, and no 'vanilla' TCP data transfer.
>
> I suspect that this *might* be an anti-debug/trace trick (am I being
> too paranoid?). It is definitely reproducible. Has anyone encountered
> similar?
You might be a bit too paranoid here, but could you send in the
tracefile showing this behavior, as I...
> The server in question is instinfo.onecare-live.com.nsatc.net.
... can't seem to reproduce it here. The site just gives me a normal SSL
handshake in the proper order.
I think you just receive the frames out-of-order, or your capturing
device might miss a packet here and there...
Cheers,
Sake
