Here's a trace, which has multiple handshake message. Anyone knows when will this message type appear?

enter image description here


I assume you mean "when will Multiple Handshake Messages appear?"

That simply indicates that multiple TLS handshake messages (server_hello and certificate in this case) showed up in the same packet.

Wireshark puts that there to indicate to you, the viewer, that there are multiple distinct handshake messages to be reviewed. It is to prevent you from looking at the top of the packet, saying "Oh, I don't care about server_hello, I'm going to keep looking at the next packet to find the certificate" without realizing they're both there.

Put differently, "Multiple Handshake Messages" isn't a TLS message type, it doesn't correspond to any bit set in the TLS packet itself, it's meta-information - a conclusion about the packet - being noted by the tool displaying the packet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.