0

I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?

Improve this question
1
  • probably is the session ID functionality, check the session id of the client hello in order to verify if you have a value, also if you upload the pcap file will help us – camp0 Sep 18 '19 at 9:01
0

You're probably seeing session resumption. If the Client Hello and Server Hello packets both have the same Session ID value, then the handshake is shortened as the Client and Server 'recognize' each other.

To quote RFC 5246:

The client sends a ClientHello using the Session ID of the session to be resumed. The server then checks its session cache for a match. If a match is found, and the server is willing to re-establish the connection under the specified session state, it will send a ServerHello with the same Session ID value. At this point, both client and server MUST send ChangeCipherSpec messages and proceed directly to Finished messages.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.