-1

I made a Wireshark tap for 2 request:

  1. a HTTP GET to a login authentication page
  2. then a HTTP POST when I send credentials to the server

wireshark tls session

As you can see, I get a warning message from Wireshark because it seems that the TLS session ID is the same for both "Server Hello" packet number 335 and packet number 400.

Is that normal behaviour?

3

As you can see, I get a warning message from Wireshark because it seems that the TLS session ID is the same for both "Server Hello" packet number 335 and packet number 400.

Notice the Severity level of the message you are receiving:

[Severity level: Note]

You are not receiving a warning message.

Is that normal behaviour?

Yes. It is completely normal for sessions to reuse previously negotiated keys. As the message says, this is session resumption

See also: What are the differences between Session Ticket and Session ID based Session Resumption?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.