problem with SSL decryption

I set the "(Pre)-Master-Secret log filename" in Preference>>SSL dialog, then open a saved Wireshark capture.

Following is the content of my keylog file derived from output of OpenSSL SSL_SESSION_print_fp() call. RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB

However Wireshark was not able to decrypt the capture. Seems Wireshark tried to restore master key even I already provided one. What is wrong here? Wireshark can not decrypt saved capture? Thanks for your helps

Following is the SSL log: /*********/ Wireshark SSL debug log

Wireshark version: 2.2.6 (v2.2.6-0-g32dac6a) GnuTLS version: 3.2.15 Libgcrypt version: 1.6.2

dissect_ssl enter frame #2181 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 99 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 94 decrypt_ssl3_record: app_data len 94, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 90 bytes, remaining 99 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #2183 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 1380 ssl_try_set_version found version 0x0303 -> state 0x11 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 58 decrypt_ssl3_record: app_data len 58, ssl state 0x11 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 ssl_try_set_version found version 0x0303 -> state 0x11 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x13 ssl_dissect_hnd_srv_hello found CIPHER 0x009C TLS_RSA_WITH_AES_128_GCM_SHA256 -> state 0x17 record: offset = 63, reported_length_remaining = 1317 need_desegmentation: offset = 63, reported_length_remaining = 1317

dissect_ssl enter frame #2189 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 3789 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 3784 decrypt_ssl3_record: app_data len 3784, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 5 length 3780 bytes, remaining 3789 lookup(KeyID)[20]: | c9 0a 25 48 8c 5a 3a 9a ee a3 df f7 a3 54 5d e9 |..%H.Z:......T].| | b7 a5 83 9f |.... | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000

dissect_ssl enter frame #2189 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 4 decrypt_ssl3_record: app_data len 4, ssl state 0x17 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9

dissect_ssl enter frame #2190 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 262 decrypt_ssl3_record: app_data len 262, ssl state 0x217 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 217 ssl_restore_master_key can't find pre-master secret by Unencrypted pre-master secret ssl_restore_master_key can't find pre-master secret by Encrypted pre-master secret dissect_ssl3_handshake can't generate pre master secret record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x217 ssl_restore_master_key can't restore master secret using an empty Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 278 40 decrypt_ssl3_record: app_data len 40, ssl state 0x217 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 103 offset 278 length 10128846 bytes, remaining 318

dissect_ssl enter frame #2192 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 258 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 202 decrypt_ssl3_record: app_data len 202, ssl state 0x217 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 198 bytes, remaining 207 ssl_save_master_key not saving empty (pre-)master secret for Session Ticket! record: offset = 207, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec ssl_dissect_change_cipher_spec Not using Session resumption trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x617 ssl_restore_master_key can't restore master secret using an empty Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 213, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 218 40 decrypt_ssl3_record: app_data len 40, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 5 offset 218 length 168283 bytes, remaining 258

dissect_ssl enter frame #2193 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 1259 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 1254, ssl state 0x617 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #2195 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 635 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 167, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available record: offset = 172, reported_length_remaining = 463 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 29, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available record: offset = 206, reported_length_remaining = 429 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 393, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available record: offset = 604, reported_length_remaining = 31 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 26, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #2196 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 34 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 29, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #2198 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000002B2DB963A0 record: offset = 0, reported_length_remaining = 31 dissect_ssl3_record: content_type 21 Alert decrypt_ssl3_record: app_data len 26, ssl state 0x617 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #2343 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000002B2DBA0C40 record: offset = 0, reported_length_remaining = 37 ssl_try_set_version found version 0x0301 -> state 0x10 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x10 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #15952 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 169 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 164 decrypt_ssl3_record: app_data len 164, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 160 bytes, remaining 169 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #15954 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 1380 need_desegmentation: offset = 0, reported_length_remaining = 1380

dissect_ssl enter frame #15957 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 3812 ssl_try_set_version found version 0x0301 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 3807 decrypt_ssl3_record: app_data len 3807, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 81 bytes, remaining 3812 ssl_try_set_version found version 0x0301 -> state 0x91 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_dissect_hnd_srv_hello found CIPHER 0xC014 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA -> state 0x97 dissect_ssl3_handshake iteration 0 type 11 offset 90 length 3383 bytes, remaining 3812 lookup(KeyID)[20]: | 22 b0 15 ac 97 7d 1b 79 cd 3f e6 30 cb 9e 45 ff |"....}.y.?.0..E.| | 62 e5 be 53 |b..S | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000 dissect_ssl3_handshake iteration 0 type 12 offset 3477 length 327 bytes, remaining 3812 dissect_ssl3_handshake iteration 0 type 14 offset 3808 length 0 bytes, remaining 3812

dissect_ssl enter frame #15958 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 70 decrypt_ssl3_record: app_data len 70, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 397 ssl_restore_master_key can't find pre-master secret by Unencrypted pre-master secret ssl_restore_master_key can't find pre-master secret by Encrypted pre-master secret dissect_ssl3_handshake can't generate pre master secret record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x397 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 86 48 decrypt_ssl3_record: app_data len 48, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 33 offset 86 length 3956207 bytes, remaining 134

dissect_ssl enter frame #15960 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec ssl_dissect_change_cipher_spec Not using Session resumption trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x397 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 11 48 decrypt_ssl3_record: app_data len 48, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 221 offset 11 length 7837630 bytes, remaining 59

dissect_ssl enter frame #15961 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 229 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 224, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #15965 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 90 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available record: offset = 37, reported_length_remaining = 53 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 48, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #15966 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 741 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 736, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #15982 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000002B2DFE7930 record: offset = 0, reported_length_remaining = 330 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available record: offset = 37, reported_length_remaining = 293 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 288, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #16634 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 362 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 357 decrypt_ssl3_record: app_data len 357, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 353 bytes, remaining 362 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #16640 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 1380 ssl_try_set_version found version 0x0303 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 61 decrypt_ssl3_record: app_data len 61, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 57 bytes, remaining 66 ssl_try_set_version found version 0x0303 -> state 0x91 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_dissect_hnd_srv_hello found CIPHER 0xC027 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 -> state 0x97 record: offset = 66, reported_length_remaining = 1314 need_desegmentation: offset = 66, reported_length_remaining = 1314

dissect_ssl enter frame #16646 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 6304 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 6299 decrypt_ssl3_record: app_data len 6299, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 11 offset 5 length 6295 bytes, remaining 6304 lookup(KeyID)[20]: | f0 fb a4 2e 75 5c 22 8b 90 73 fd 60 d3 24 be f5 |....u\"..s.`.$..| | 29 4c ed ee |)L.. | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000

dissect_ssl enter frame #16646 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 333 decrypt_ssl3_record: app_data len 333, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 12 offset 5 length 329 bytes, remaining 338 record: offset = 338, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 343 4 decrypt_ssl3_record: app_data len 4, ssl state 0x97 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 14 offset 343 length 0 bytes, remaining 347

dissect_ssl enter frame #16648 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 166 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 70 decrypt_ssl3_record: app_data len 70, ssl state 0x297 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 297 ssl_restore_master_key can't find pre-master secret by Unencrypted pre-master secret ssl_restore_master_key can't find pre-master secret by Encrypted pre-master secret dissect_ssl3_handshake can't generate pre master secret record: offset = 75, reported_length_remaining = 91 dissect_ssl3_record: content_type 20 Change Cipher Spec trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x297 ssl_restore_master_key can't restore master secret using an empty Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 85 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 86 80 decrypt_ssl3_record: app_data len 80, ssl state 0x297 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 157 offset 86 length 5416502 bytes, remaining 166

dissect_ssl enter frame #16649 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 282 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 186 decrypt_ssl3_record: app_data len 186, ssl state 0x297 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 4 offset 5 length 182 bytes, remaining 191 ssl_save_master_key not saving empty (pre-)master secret for Session Ticket! record: offset = 191, reported_length_remaining = 91 dissect_ssl3_record: content_type 20 Change Cipher Spec ssl_dissect_change_cipher_spec Not using Session resumption trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x697 ssl_restore_master_key can't restore master secret using an empty Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 197, reported_length_remaining = 85 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 202 80 decrypt_ssl3_record: app_data len 80, ssl state 0x697 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 202 length 1958508 bytes, remaining 282

dissect_ssl enter frame #16652 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 229 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 224, ssl state 0x697 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #16654 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000002B2E015FB0 record: offset = 0, reported_length_remaining = 437 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 432, ssl state 0x697 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #17526 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000002B2DBA0C40 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x10 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #17777 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 221 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 216 decrypt_ssl3_record: app_data len 216, ssl state 0x00 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 1 offset 5 length 212 bytes, remaining 221 ssl_dissect_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #17778 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 1380 need_desegmentation: offset = 0, reported_length_remaining = 1380

dissect_ssl enter frame #17781 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 3814 ssl_try_set_version found version 0x0303 -> state 0x91 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 3809 decrypt_ssl3_record: app_data len 3809, ssl state 0x91 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 2 offset 5 length 81 bytes, remaining 3814 ssl_try_set_version found version 0x0303 -> state 0x91 ssl_dissect_hnd_hello_common found SERVER RANDOM -> state 0x93 ssl_dissect_hnd_srv_hello found CIPHER 0xC028 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 -> state 0x97 dissect_ssl3_handshake iteration 0 type 11 offset 90 length 3383 bytes, remaining 3814 lookup(KeyID)[20]: | 22 b0 15 ac 97 7d 1b 79 cd 3f e6 30 cb 9e 45 ff |"....}.y.?.0..E.| | 62 e5 be 53 |b..S | ssl_find_private_key_by_pubkey: lookup result: 0000000000000000 dissect_ssl3_handshake iteration 0 type 12 offset 3477 length 329 bytes, remaining 3814 dissect_ssl3_handshake iteration 0 type 14 offset 3810 length 0 bytes, remaining 3814

dissect_ssl enter frame #17782 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 5 70 decrypt_ssl3_record: app_data len 70, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_generate_pre_master_secret: found SSL_HND_CLIENT_KEY_EXCHG, state 397 ssl_restore_master_key can't find pre-master secret by Unencrypted pre-master secret ssl_restore_master_key can't find pre-master secret by Encrypted pre-master secret dissect_ssl3_handshake can't generate pre master secret record: offset = 75, reported_length_remaining = 107 dissect_ssl3_record: content_type 20 Change Cipher Spec trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x397 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - FALSE ssl_change_cipher CLIENT record: offset = 81, reported_length_remaining = 101 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 86 96 decrypt_ssl3_record: app_data len 96, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 181 offset 86 length 15566022 bytes, remaining 182

dissect_ssl enter frame #17785 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 107 dissect_ssl3_record: content_type 20 Change Cipher Spec ssl_dissect_change_cipher_spec Not using Session resumption trying to use SSL keylog in D:\WCTP_HTTPS_ESR\master_key.log ssl_load_keyfile file got deleted, trying to re-open checking keylog line: RSA Session-ID:C57BC00D149D39A5F2879F744AE4A674ED6B8DA19308142895649621209979D4 Master-Key:1889D2C581BE9A65F61E398618C095B56826E3E46B98749D720FFEDFF3F6289B10A411135AEAD360C3B4F69EC225DBDB matched session_id ssl_finalize_decryption state = 0x397 ssl_restore_master_key can't find master secret by Session ID ssl_restore_master_key can't find master secret by Client Random Cannot find master secret packet_from_server: is from server - TRUE ssl_change_cipher SERVER record: offset = 6, reported_length_remaining = 101 dissect_ssl3_record: content_type 22 Handshake Calculating hash with offset 11 96 decrypt_ssl3_record: app_data len 96, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available dissect_ssl3_handshake iteration 1 type 144 offset 11 length 4506277 bytes, remaining 107

dissect_ssl enter frame #17786 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 277 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 272, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #17788 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 96, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #17789 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 949 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 944, ssl state 0x397 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #17792 (first time) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000002B2E05E2E0 record: offset = 0, reported_length_remaining = 341 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 336, ssl state 0x397 packet_from_server: is from server - TRUE decrypt_ssl3_record: using server decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #29820 (first time) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000002B2DBA0C40 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 23 Application Data decrypt_ssl3_record: app_data len 32, ssl state 0x10 packet_from_server: is from server - FALSE decrypt_ssl3_record: using client decoder decrypt_ssl3_record: no decoder available

dissect_ssl enter frame #2181 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 99 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 90 bytes, remaining 99

dissect_ssl enter frame #2183 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1380 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63 record: offset = 63, reported_length_remaining = 1317 need_desegmentation: offset = 63, reported_length_remaining = 1317

dissect_ssl enter frame #2189 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 3789 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 3780 bytes, remaining 3789

dissect_ssl enter frame #2189 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 5 length 0 bytes, remaining 9

dissect_ssl enter frame #2190 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 318 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267 record: offset = 267, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 273, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 103 offset 278 length 10128846 bytes, remaining 318

dissect_ssl enter frame #2192 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 258 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 198 bytes, remaining 207 record: offset = 207, reported_length_remaining = 51 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 213, reported_length_remaining = 45 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 5 offset 218 length 168283 bytes, remaining 258

dissect_ssl enter frame #2193 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1259 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #2195 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 635 dissect_ssl3_record: content_type 23 Application Data record: offset = 172, reported_length_remaining = 463 dissect_ssl3_record: content_type 23 Application Data record: offset = 206, reported_length_remaining = 429 dissect_ssl3_record: content_type 23 Application Data record: offset = 604, reported_length_remaining = 31 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #2196 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 34 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #2198 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DB959D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 31 dissect_ssl3_record: content_type 21 Alert

dissect_ssl enter frame #2343 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #15952 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 169 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 160 bytes, remaining 169

dissect_ssl enter frame #15957 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 3812 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 81 bytes, remaining 3812 dissect_ssl3_handshake iteration 0 type 11 offset 90 length 3383 bytes, remaining 3812 dissect_ssl3_handshake iteration 0 type 12 offset 3477 length 327 bytes, remaining 3812 dissect_ssl3_handshake iteration 0 type 14 offset 3808 length 0 bytes, remaining 3812

dissect_ssl enter frame #15958 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 134 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 record: offset = 75, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 81, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 33 offset 86 length 3956207 bytes, remaining 134

dissect_ssl enter frame #15960 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 59 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 6, reported_length_remaining = 53 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 221 offset 11 length 7837630 bytes, remaining 59

dissect_ssl enter frame #15961 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 229 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #15965 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 90 dissect_ssl3_record: content_type 23 Application Data record: offset = 37, reported_length_remaining = 53 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #15966 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 741 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #15982 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2DFE6F20, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 330 dissect_ssl3_record: content_type 23 Application Data record: offset = 37, reported_length_remaining = 293 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #16634 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 362 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 353 bytes, remaining 362

dissect_ssl enter frame #16640 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 1380 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 57 bytes, remaining 66 record: offset = 66, reported_length_remaining = 1314 need_desegmentation: offset = 66, reported_length_remaining = 1314

dissect_ssl enter frame #16646 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 6304 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 11 offset 5 length 6295 bytes, remaining 6304

dissect_ssl enter frame #16646 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 347 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 12 offset 5 length 329 bytes, remaining 338 record: offset = 338, reported_length_remaining = 9 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 14 offset 343 length 0 bytes, remaining 347

dissect_ssl enter frame #16648 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 166 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 record: offset = 75, reported_length_remaining = 91 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 81, reported_length_remaining = 85 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 157 offset 86 length 5416502 bytes, remaining 166

dissect_ssl enter frame #16649 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 282 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 4 offset 5 length 182 bytes, remaining 191 record: offset = 191, reported_length_remaining = 91 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 197, reported_length_remaining = 85 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 202 length 1958508 bytes, remaining 282

dissect_ssl enter frame #16652 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 229 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #16654 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E015250, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 437 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #17526 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #17777 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 221 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 1 offset 5 length 212 bytes, remaining 221

dissect_ssl enter frame #17781 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 3814 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 2 offset 5 length 81 bytes, remaining 3814 dissect_ssl3_handshake iteration 0 type 11 offset 90 length 3383 bytes, remaining 3814 dissect_ssl3_handshake iteration 0 type 12 offset 3477 length 329 bytes, remaining 3814 dissect_ssl3_handshake iteration 0 type 14 offset 3810 length 0 bytes, remaining 3814

dissect_ssl enter frame #17782 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 182 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75 record: offset = 75, reported_length_remaining = 107 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 81, reported_length_remaining = 101 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 181 offset 86 length 15566022 bytes, remaining 182

dissect_ssl enter frame #17785 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 107 dissect_ssl3_record: content_type 20 Change Cipher Spec record: offset = 6, reported_length_remaining = 101 dissect_ssl3_record: content_type 22 Handshake dissect_ssl3_handshake iteration 1 type 144 offset 11 length 4506277 bytes, remaining 107

dissect_ssl enter frame #17786 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 277 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #17788 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 101 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #17789 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 949 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #17792 (already visited) packet_from_server: is from server - TRUE conversation = 0000002B2E05D1F0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 341 dissect_ssl3_record: content_type 23 Application Data

dissect_ssl enter frame #29820 (already visited) packet_from_server: is from server - FALSE conversation = 0000002B2DBA06D0, ssl_session = 0000000000000000 record: offset = 0, reported_length_remaining = 37 dissect_ssl3_record: content_type 23 Application Data