ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] ssl digestor truncates the Server Hello ?

From: Arnaud grandville <Arnaud.grandville@xxxxxxxxxx>
Date: Wed, 19 Dec 2012 17:50:24 +0100
Hi everyone,

I'm using WireShark to analyze an https connection, but I encounter a problem with the ssl digestor.
In response to the Client Hello (#4), I expected to get a Server Hello response with some additional informations like:
- TLSv1 Record Layer: Handshake Protocol: Server Hello
- TLSv1 Record Layer: Handshake Protocol: Certificate
- TLSv1 Record Layer: Handshake Protocol: Server Key Exchange
- TLSv1 Record Layer: Handshake Protocol: Server Hello Done
But, as my joined capture shows, the packet #8 contains only "TLSv1 Record Layer: Handshake Protocol: Server Hello" whereas the binary streams contains some additional informations (certificates ....)

Do you have any idea ?

Thank's
Arnaud

Attachment: Google.pcap
Description: Google.pcap