I am a bit confused where exactly to get the TLS version value that is sent in the ClientHello from? Wireshark has three places where versions appear, and they are not unified in a single handshake.
There is a version under the the "record", under the "handshake", and one in the "Protocol" in the view. I strongly believe that the handshake version is the one being negotiated. However, which version is the one that appears in the "Protocol" column in the view? What affects this value? Also what does affect the version in the "record"?
