wireshark_Reset,ACK in the trace

Question

I have captured some data for a client, and the capture is an ssl3. from what I can tell it looks like the servers are communication using the three way handshake, then the two server communicate over a secure, connection, and then a https connection is initiated by one of the server or the application, and finally transitions process ends with fin -ack -ack -Rst, ack and the process start over.

Question? Am I correct on that or is something else going on in the trace thanks for the help in advance.

https://www.cloudshark.org/captures/9e2ba03160c3

Answer 1

There is no data transfer in the sessions in your tracefile. Although the snaplength prevents Wireshark from displaying the SSL handshake properly, the following sequence can be assumed, based on normal (resumed) SSL handshakes:

1 C->S: SYN
2 S->C: SYN/ACK
3 C->S: ACK
4 C->S: ClientHello
5 S->C: ServerHello, ChangeCipherSpec, Finished
6 C->S: ChangeCipherSpec, Finished
7 C->S: FIN
8 S->C: ACK
9 S->C: RST

Between frame 6 and 7 there should have been "ApplicationData" messages if there was data transfer between the two systems. Since the client is closing the connection, and the interval between the sessions is exactly 64 seconds (filter on tcp.flags==2 and look at the time difference between the odd lines and then the time difference between the even lines), it looks like there are two processes on 10.97.4.65 are monitoring the availability of the server by just performing the SSL handshake.

EDIT: removed the ServerHelloDone, as it is not part of a resumed SSL handshake