Does Wireshark understand NPN (or at least NPN extension in SSL)

Question

I am using wireshark 1.6.7 on windowx XP. It does not seem to understand if the SSL client sends NPN (next protocol negotiation) extension. I tried to run on centos 1.2.15 with the same result. I have googled but it is not clear from the documentation if NPN is recognized or if some patch needs to be applied Thanks for any answers

Accepted Answer

1.6.7 is pretty old by now - have you tried the latest builds? Maybe they do support those extensions now. 1.2 is even older, so if you can, get 1.10, or compile it yourself if there is no package.

Answer 2

There is support for NPN:

static gint dissect_ssl3_hnd_hello_ext_npn(tvbuff_t *tvb,
                                       proto_tree *tree, guint32 offset, guint32 ext_len);

(from epan/dissectors/packet-ssl.c)

Checking "Display Filter Reference: Secure Sockets Layer" gives:

ssl.handshake.extensions_npn    Next Protocol   Character string    1.8.0 to 1.10.2

So it has been supported since 1.8.0. Please upgrade wireshark or compile a recent version yourself if not available for your distro.