TLS Record has two versions

TLS
Version

asked 2019-06-27 15:41:01 +0000

feenyman99
108 ●23 ●26 ●35

Hello. I am analyzing TLS packets, in support of my company's effort to restrict all TLS sessions to use version 1.2.

I have been aware for some time that there is both a Record version, and a Handshake version, in a TLS packet. But today was the first time I saw two different versions seemingly associated with the Record. Here is what I'm seeing...

image description

Can anyone explain how to interpret these two "Record versions"?

Thx, feenyman99

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2019-06-27 20:20:22 +0000

Jaap

13742 ●711 ●115

Look into the TLS handshake itself, there you'll see the handshake version which is the version the client supports. This, when agreed by the server, will define the version listed for the record layer.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-06-27 15:41:01 +0000

Seen: 518 times

Last updated: Jun 27 '19

TLS Record has two versions edit

1 Answer