Hi all I am analyzing a captured TLS/SSL session with Wireshark. Although I know that its a HTTPS session I wonder how Wireshark can indicate the Application Data as HTTP too. Every since the record structure for Application Data provides Content Type (23) and Application Data Length only! Example: SSLv3 Record Layer: Application Data Protocol: http Any help on this is very much appreciated! Thanks asked 14 Aug '12, 07:08  sky21 |
One Answer:
it cannot. That peace of information is just added by the HTTP dissector while registering the SSL dissector to handle SSL/TLS sessions. See:
Regards answered 14 Aug '12, 08:05  Kurt Knochner ♦ edited 14 Aug '12, 08:07 |
Hi Kurt and thanks for the information so far!
But... how DOES the SSL dissector know, that it encapsulates an encrypted HTTP content? Is it because of the target tcp port 443 (...which might indicate that HTTPS service is used)?
(I converted your answer to a comment, please reread the FAQ)
Yes, Identification is done based on the port number. The HTTP dissector tells the SSL dissector that all traffic on port 443 is encrypted HTTP traffic. Even though it might not be.