1

I'd like to capture the TLS resumption traffic using Wireshark. The traffic is recorded while I open a connection in a tab, close it and then re-enter the url and load again. I've noticed two traffic patterns. One is full handshake. However, the other doesn't seem like a TLS resumption. Any any expert help to confirm it or suggest a correct way to obtain resumption traffic? Thanks.

The screenshot below shows a full handshake

full handshake

this is another pattern. Can this be TLS resumption pattern? However, it's not like the normal resumption handshake as described in some document.

This is another pattern. Can this be TLS resumption pattern? However, it's not like the normal resumption handshake as described in some document

1

...normal resumption handshake as described in some document...

It is unclear what some document you are referring to is and what you consider normal. Session resumption can be done with either session id or session ticket. While your capture shows that no session id was used there is nothing known or shown about the use of session tickets. Therefore my guess is that you did not know about session ticket and thus did not look for it.

Also, given that the ClientHello you show in the screenshots have the same random bytes it is likely that both screenshots actually show the same ClientHello (i.e. either from first or from second, don't know) which makes analysis based on your screenshots hard.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.