Wireshark · Wireshark-users: [Wireshark-users] Malformed SSL - Is it really?

["Small, James" <JSmall@xxxxxxxxxxxx>]

Hello,

 

When using Wireshark 0.99.5 on Windows, sometimes I see:

[Malformed Packet: SSL]

 

e.g.:

No.     Time        Source                Destination           Protocol Src Port Dst Port Delta       Info
    381 15.301101   172.24.101.100        172.24.100.107        TLSv1    443      1136     0.017923    Application Data, [Malformed Packet]

Frame 381 (1314 bytes on wire, 1314 bytes captured)
    Arrival Time: Apr 10, 2007 10:20:40.195898000
    [Time delta from previous packet: 0.017923000 seconds]
    [Time since reference or first frame: 15.301101000 seconds]
    Frame Number: 381
    Packet Length: 1314 bytes
    Capture Length: 1314 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:tcp:http:ssl]
    [Coloring Rule Name: HTTP]
    [Coloring Rule String: http || tcp.port == 80]
Ethernet II, Src: StBernar_00:8c:e5 (00:07:e8:00:8c:e5), Dst: Dell_00:be:6b (00:12:3f:00:be:6b)
Internet Protocol, Src: 172.24.101.100 (172.24.101.100), Dst: 172.24.100.107 (172.24.100.107)
Transmission Control Protocol, Src Port: 3128 (3128), Dst Port: 1136 (1136), Seq: 9184, Ack: 1341, Len: 1260
Hypertext Transfer Protocol
Secure Socket Layer
    TLSv1 Record Layer: Application Data Protocol: http
        Content Type: Application Data (23)
        Version: TLS 1.0 (0x0301)
        Length: 1048
        Encrypted Application Data: 986EF11CE4141826D529372C664768C27C0E749FFC4BB768...
[Malformed Packet: SSL]

Is the packet really malformed, or is it possible that Wireshark doesn't support the cipher being used?  If so, is there any way to tell if the packet is really malformed versus Wireshark just not understanding it/the encryption scheme?

 

Thanks,

  --Jim