Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:
(ssp_ssl) Invalid Client HELLO after Server HELLO Detected
It seems like this must be in the network stack somewhere, as it happens regardless of which application is using the SSL connection.
Does anyone know why this is, or whether there is any reason to be concerned?
I'm going to quote this post from SecLists.org
Those alerts are supposed to fire when an SSL Client Hello is seen in a session, but the SSL preprocessor already saw both a Client Hello and a Server Hello. The alerts were added to the preprocessor as part of Snort 2.9.0.
The best thing I've seen to do is suppress the specific alerts. This tutorial on Youtube is quite informative on how to do so.
