I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect these invalid SSL/TLS handshakes in Wireshark? Or any other tool for this purpose?
0
-
1Please make clear what you consider "invalid SSL/TLS handshake": not conforming to RFC, not finished because of errors, weak ciphers, wrong/untrusted certificates, ..... In any case I doubt that you'll find a ready-made tool to identify these. – Steffen Ullrich Jan 18 at 8:57
-
It came to my mind that you can use aiengine and dump the ssl information and do your own heuristic of what is an invalid handshake, close TCP connection with no pdus? weak ciphers?, etc.. – camp0 Jan 18 at 9:27
