This is our old Q&A Site. Please post any new questions and answers at

I'm trying to look at the TLS handshake messages for a session, and I am getting different results when I open the capture in Wireshark 2.2.5 in Windows 10 vs Ubuntu 16.04. In Windows it identifies the protocol as TLSv1.2 and shows the Client Hello and Server Hello messages. In Ubuntu it just shows the Client Hello, and then the rest of the messages are left uninterpreted as just SSL.

I installed Wireshark from

What am I missing in my Linux install that would let it interpret the Server Hello message?

Thank you so much! Screenshots of the capture are below.

Capture From Windows 10: Windows Capture

Capture from Ubuntu 16.04 Ubuntu Capture

asked 10 Apr '17, 16:36

DevinCallahan's gravatar image

accept rate: 0%

On Ubuntu it seems like reassembly is not working, is it the same Wireshark version on both systems? if so compare your preference settings.

(11 Apr '17, 01:54) Anders ♦

Given that the protocol is just "SSL" (rather than a more specific version like "TLSv1.2") and given that some packets are reported as "Continuation Data", I think that you have disabled TCP reassembly.

To enable TCP reassembly, right-click on the TCP layer, select Protocol Preferences and check the Allow subdissector to reassemble TCP streams option.


permanent link

answered 12 Apr '17, 14:12

Lekensteyn's gravatar image

accept rate: 30%

That was it! Thank you so much!

(12 Apr '17, 14:16) DevinCallahan
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 10 Apr '17, 16:36

question was seen: 1,758 times

last updated: 12 Apr '17, 14:16

p​o​w​e​r​e​d by O​S​Q​A