I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA
transmit data as shown. From my understanding, the ciphertext must be a multiple of the block size, which in this case is 16 bytes. However, when I look at the below output from Wireshark, I'm confused.
After subtracting the 16 bytes corresponding to the IV from the beginning of the Encrypted Application Data, that leaves 100 bytes of ciphertext which is obviously not a multiple of 16. What am I not understanding?
EDIT: Based on the structure of the struct in the above link, I was under the impression that the MAC was appended to the plaintext prior to encryption and thus included in the ciphertext.