TLSV1 “Ignored Unknown Record”

You probably have a SMTP handshake happening before the TLS negotiation. See http://en.wikipedia.org/wiki/SMTP_Authentication . So, if you do the "Decode as SSL" on all packets wireshark will treat those as unknown TLS.

> S: 220 smtp.example.com ESMTP Server  
> C: EHLO client.example.com   S:
> 250-smtp.example.com Hello
> client.example.com   S: 250-AUTH
> GSSAPI DIGEST-MD5   S:
> 250-ENHANCEDSTATUSCODES   S: 250
> STARTTLS   C: STARTTLS   S: 220 Ready
> to start TLS
>     ... TLS negotiation proceeds. 
>      Further commands protected by TLS layer ...   C: EHLO client.example.com
> S: 250-smtp.example.com Hello
> client.example.com   S: 250 AUTH
> GSSAPI DIGEST-MD5 PLAIN   C: AUTH
> PLAIN dGVzdAB0ZXN0ADEyMzQ=   S: 235
> 2.7.0 Authentication successful

What else may cause Ignored Unknown Record ?

Maybe your mail server (deducted from the phrase 'mailflow') uses a TLS record type that is unknown to Wireshark (in general, or the version you are using).

From the code: packet-ssl.c

       / TLS 1.0/1.1 just ignores unknown records - RFC 2246 chapter 6. The TLS Record Protocol /
        if ((conv_version==SSL_VER_TLS || conv_version==SSL_VER_TLSv1DOT1 || *conv_version==SSL_VER_TLSv1DOT2) &&
            (available_bytes >=1 ) && !ssl_is_valid_content_type(tvb_get_guint8(tvb, offset))) {
            proto_tree_add_text(tree, tvb, offset, available_bytes, "Ignored Unknown Record");

Then from RFC2246 chapter 6

   Any new record types should
   allocate type values immediately beyond the ContentType values for
   the four record types described here (see Appendix A.2). If a TLS
   implementation receives a record type it does not understand, it
   should just ignore it.

Then from packet-ssl-utils.c

int
ssl_is_valid_content_type(guint8 type)
{
    if ((type >= 0x14) && (type <= 0x18))
    {
        return 1;
    }
return 0;</code></pre><p>So, Wireshark will only be able to 'understand' types between 0x14 and 0x18. What do you see in your capture file?</p><p>Regards<br />

Kurt