This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Getting Encrypt Alert from Client after Application Data exchange

0

I am getting a Encryption alert from the client after the server and client have exchanged application data. The Error codes do not seem consistent between the Alert Description Types. Why would the client send an alert after several application packets have passed successfully? Thank you in advance. Dan

asked 16 Jan '13, 15:58

DanS's gravatar image

DanS
1111
accept rate: 0%


2 Answers:

1

Assuming the traffic is https, what is the order in which you see "application data". This can most easily be seen when using a filter "tcp.len>0". Do you application data from the client, then application data from the server and then the EncryptedAlert from the client (without the server first sending an EncryptedAlert or TCP-FIN? Is there a delay between the last Application data packet and the EncryptedAlert?

The connection is kept open on the application level (http). So you need to look into the KeepAlive settings of the embedded server or the http settings on the client to make the session last longer. Also SSL session caching can reduce the workload on the embedded server, if it supports it.

answered 17 Jan '13, 07:43

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

0

It is probably not an error. You will see alerts as a notification that the encrypted session is going to be terminated after the data exchange was complete, which is perfectly normal. IIRC it is designed like this to make it harder for attackers to spoof session termination packets.

answered 16 Jan '13, 16:02

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you Jasper. We have an embedded server and the handshake is hurting our performance for the web session. Is there a way to keep the connection open? I haven't found a linger option in SSL. There is one for the socket connection which we have set, but it doesn't help if SSL is shutting the connection down. Thanks again. Dan

(17 Jan '13, 07:06) DanS

Is there a way to keep an SSL connection open?

(17 Jan '13, 07:08) DanS