I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:

(ssp_ssl) Invalid Client HELLO after Server HELLO Detected

It seems like this must be in the network stack somewhere, as it happens regardless of which application is using the SSL connection.

Does anyone know why this is, or whether there is any reason to be concerned?

1 Answer 1


I'm going to quote this post from SecLists.org

Those alerts are supposed to fire when an SSL Client Hello is seen in a session, but the SSL preprocessor already saw both a Client Hello and a Server Hello. The alerts were added to the preprocessor as part of Snort 2.9.0.

The best thing I've seen to do is suppress the specific alerts. This tutorial on Youtube is quite informative on how to do so.

  • 2
    I understand what the message is saying; what I don't know is why Apple products are fouling up one of the most widely-used protocols. As such, I wouldn't want to suppress that until I discover why, and if there are any credible threats that might warn against.
    – Bryan Agee
    Mar 28, 2012 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.