This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm developing a subdissector under SSL. When I test it, I found that most of the packets are dissected properly where some of them are dissected as "Ignored Unknown Record". I noticed these cases get (always) properly dissected: a single PDU embedded in a single SSL frame or multiple PDUs embedded in a single SSL frame. However, the case where a single PDU is a crosse multiple SSL frames is not (attached screenshot)! Dissection works fine if the next involved frame is a reassembled one (looks as "Application Data" in the Info column) but fails when it is a "[TCP segment of a reassembled PDU]".

W]hen I tried to dissect the same dump without the related decryption keys, I found that the packets which appear as "[TCP segment of a reassembled PDU]" are the ones which dissected as"Ignored Unknown Record" when I use the keys.

Based on that, I can only think there is something wrong with the reassembling but I'm not sure where?

Here is my relate dump (no keys provided!)

Part of My ssl_debug_file

 avialble =548 
 required = 514 
 Yes we have enough bytes for #310 
 done dissecting 
 avialble =34 
 required = 514 
No enough bytes for #310 we need 480 more

dissect_ssl enter frame #312 (first time)
packet_from_server: is from server - TRUE
  conversation = 0x7fb399607058, ssl_session = 0x7fb3721867e0
  record: offset = 0, reported_length_remaining = 1368
Unknown Record because of the session version is 3 and the returned type is 206

dissect_ssl enter frame #313 (first time)
packet_from_server: is from server - TRUE
 conversation = 0x7fb399607058, ssl_session = 0x7fb3721867e0
 record: offset = 0, reported_length_remaining = 1368
 Unknown Record because of the session version is 3 and the returned type is 133

alt text

asked 04 Aug '15, 09:18

flora's gravatar image

flora
156313338
accept rate: 100%

edited 05 Aug '15, 05:54

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×319
×19
×1

question asked: 04 Aug '15, 09:18

question was seen: 3,248 times

last updated: 05 Aug '15, 05:54

p​o​w​e​r​e​d by O​S​Q​A