Wireshark SSL debug log Wireshark version: 2.6.1 (v2.6.1-0-g860a78b3) GnuTLS version: 3.4.11 Libgcrypt version: 1.7.6 ssl_association_remove removing UDP 443 - handle 0000000008541DA0 KeyID[20]: | 14 dd 66 d0 6a e4 f5 e8 ad 43 55 7f 83 83 f5 47 |..f.j....CU....G| | 67 29 4a cb |g)J. | ssl_init private key file C:/Users/Documents/Projects/Cert/IHS_Cert.txt.pfx successfully loaded. ssl_init port '443' filename 'C:/Users/Documents/Projects/Cert/IHS_Cert.txt.pfx' password(only for p12 file) 'Password1' association_add ssl.port port 443 handle 0000000008541DA0 dissect_ssl enter frame #4 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 177 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 172, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 168 bytes, remaining 177 Calculating hash with offset 5 172 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01 dissect_ssl enter frame #5 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1460 ssl_try_set_version found version 0x0303 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 81, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 ssl_try_set_version found version 0x0303 -> state 0x91 Calculating hash with offset 5 81 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_set_cipher found CIPHER 0x009D TLS_RSA_WITH_AES_256_GCM_SHA384 -> state 0x97 ssl_load_keyfile dtls/ssl.keylog_file is not configured! tls13_load_secret TLS version 0x303 is not 1.3 tls13_load_secret TLS version 0x303 is not 1.3 record: offset = 86, reported_length_remaining = 1374 need_desegmentation: offset = 86, reported_length_remaining = 1374 dissect_ssl enter frame #8 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 4762 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4757, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4753 bytes, remaining 4762 Calculating hash with offset 5 4757 lookup(KeyID)[20]: | 76 52 ac fb 6b 37 a2 af f0 ae 4f 48 e9 a2 11 0d |vR..k7....OH....| | 6f 0e 41 8c |o.A. | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000 dissect_ssl enter frame #8 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 4, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9 Calculating hash with offset 5 4 dissect_ssl enter frame #11 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 262, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 Calculating hash with offset 5 262 ssl_load_keyfile dtls/ssl.keylog_file is not configured! ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 97 ssl_restore_master_key can't find pre-master secret by Unencrypted pre-master secret ssl_restore_master_key can't find pre-master secret by Encrypted pre-master secret dissect_ssl3_handshake can't generate pre master secret record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec decrypt_ssl3_record: app_data len 1, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available ssl_load_keyfile dtls/ssl.keylog_file is not configured! ssl_finalize_decryption state = 0x97 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 40, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #13 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 6 dissect_ssl3_record: content_type 20 Change Cipher Spec decrypt_ssl3_record: app_data len 1, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available ssl_dissect_change_cipher_spec Not using Session resumption ssl_load_keyfile dtls/ssl.keylog_file is not configured! ssl_finalize_decryption state = 0x97 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - TRUE ssl_change_cipher SERVER dissect_ssl enter frame #14 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake decrypt_ssl3_record: app_data len 40, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 0 bytes, remaining 45 dissect_ssl enter frame #16 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 683 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 678, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #17 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 1048, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available record: offset = 1053, reported_length_remaining = 407 need_desegmentation: offset = 1053, reported_length_remaining = 407 dissect_ssl enter frame #21 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 2077 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 2072, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #21 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1250 need_desegmentation: offset = 0, reported_length_remaining = 1250 dissect_ssl enter frame #22 (first time) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1993 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 1988, ssl state 0x97 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #24 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1460 need_desegmentation: offset = 0, reported_length_remaining = 1460 dissect_ssl enter frame #25 (first time) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 000000000B36F7F0 record: offset = 0, reported_length_remaining = 1889 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 1884, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl enter frame #4 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 168 bytes, remaining 177 dissect_ssl enter frame #5 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 record: offset = 86, reported_length_remaining = 1374 need_desegmentation: offset = 86, reported_length_remaining = 1374 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4762 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4753 bytes, remaining 4762 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9 dissect_ssl enter frame #11 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #13 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 6 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl enter frame #14 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 0 bytes, remaining 45 dissect_ssl enter frame #16 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 683 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #17 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 23 Application Data record: offset = 1053, reported_length_remaining = 407 need_desegmentation: offset = 1053, reported_length_remaining = 407 dissect_ssl enter frame #21 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 2077 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1993 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #25 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1889 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #4 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 168 bytes, remaining 177 dissect_ssl enter frame #5 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 record: offset = 86, reported_length_remaining = 1374 need_desegmentation: offset = 86, reported_length_remaining = 1374 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4762 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4753 bytes, remaining 4762 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9 dissect_ssl enter frame #11 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #13 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 6 dissect_ssl3_record: content_type 20 Change Cipher Spec dissect_ssl enter frame #14 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 0 bytes, remaining 45 dissect_ssl enter frame #16 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 683 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #17 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 23 Application Data record: offset = 1053, reported_length_remaining = 407 need_desegmentation: offset = 1053, reported_length_remaining = 407 dissect_ssl enter frame #4 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 177 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 168 bytes, remaining 177 dissect_ssl enter frame #5 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1460 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 77 bytes, remaining 86 record: offset = 86, reported_length_remaining = 1374 need_desegmentation: offset = 86, reported_length_remaining = 1374 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 4762 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 4753 bytes, remaining 4762 dissect_ssl enter frame #8 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9 dissect_ssl enter frame #11 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #11 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #11 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 0 offset 278 length 0 bytes, remaining 318 dissect_ssl enter frame #21 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 2077 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #22 (already visited) packet_from_server: is from server - FALSE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1993 dissect_ssl3_record: content_type 23 Application Data dissect_ssl enter frame #25 (already visited) packet_from_server: is from server - TRUE conversation = 000000000B36EB50, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1889 dissect_ssl3_record: content_type 23 Application Data