Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:

(ssp_ssl) Invalid Client HELLO after Server HELLO Detected

It seems like this must be in the network stack somewhere, as it happens regardless of which application is using the SSL connection.

Does anyone know why this is, or whether there is any reason to be concerned?

share|improve this question

I'm going to quote this post from

Those alerts are supposed to fire when an SSL Client Hello is seen in a session, but the SSL preprocessor already saw both a Client Hello and a Server Hello. The alerts were added to the preprocessor as part of Snort 2.9.0.

The best thing I've seen to do is suppress the specific alerts. This tutorial on Youtube is quite informative on how to do so.

share|improve this answer
I understand what the message is saying; what I don't know is why Apple products are fouling up one of the most widely-used protocols. As such, I wouldn't want to suppress that until I discover why, and if there are any credible threats that might warn against. – Bryan Agee Mar 28 '12 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.