0

I have a python client. Using ssl.SSLContext() (documentation here) and set_ciphers(myciphers) (where myciphers is my list of ciphersuites that I change with every handshake, i.e., with every socket connection). I can control the list of the client ciphersuites. The default SSLContext in python disable SSL 2.0 and SSL 3.0 by default and I do not any change to the versions in my client's code.

I send 3 handshakes to the website using different ciphersuite list in each one. I do not change the version.

In Wireshark, the ClientHello in the "protocol" column, I see different versions? I am contacting the same site. The client does not change the version.

1) Can you please explain to me why I see different TLS protocol version? 2) If this is not the actual version the client offer (which should be TLS 1.2), where can I get the actual client offered TLS version?

Here is a screenshot to clarify (please excuse its shape but to to anonymize the sites and PC names): enter image description here

EDIT: Although the ClientHello column shows TLSv1, when I click ont he record and see the expanded area. I see this:

> Secure Socket Layer
 > TLSv1.2 Record Layer: Handshake Protocol: Client Hello

I am confused. It is very important to me to ensure that my client always tries TLS 1.2. I left the python's default which should do this according to their documentation.

EDIT 2: I do view filter to see TLS 1.0 (as the screen show, there ClientHellos sending TLSv1). But with this view filter:

ssl.handshake.version==0x0301

No ClientHello messages appear to me. Only some ServerHello. Please, explain to me. This is rather confusing.

  • Seems possible that you may have found a bug in the Wireshark dissector for TLS (or whatever code fills in the protocol name in whatever column you’re showing in the summary window). Can you find a certain cipher in the cipher suite that triggers it? Maybe some ciphers were deprecated before TLS 1.2 so anytime those deprecated ciphers show up, that summary column says it must be TLS 1.0. – Spiff Aug 6 '18 at 5:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.