I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
-
probably is the session ID functionality, check the session id of the client hello in order to verify if you have a value, also if you upload the pcap file will help us – camp0 Sep 18 '19 at 9:01
You're probably seeing session resumption. If the Client Hello and Server Hello packets both have the same Session ID value, then the handshake is shortened as the Client and Server 'recognize' each other.
To quote RFC 5246:
The client sends a ClientHello using the Session ID of the session to be resumed. The server then checks its session cache for a match. If a match is found, and the server is willing to re-establish the connection under the specified session state, it will send a ServerHello with the same Session ID value. At this point, both client and server MUST send ChangeCipherSpec messages and proceed directly to Finished messages.
answered Sep 18 '19 at 0:04
