Wireshark-users: Re: [Wireshark-users] malformed ssl packet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Fri, 13 Feb 2009 18:37:35 +0100
On Fri, Feb 13, 2009 at 01:14:48PM +0100, Toralf Förster wrote:
> Hello,
> 
> I'm wondering why packet #17 is malformed in the attached stream, it looks 
> like a common error message.

It's a strange converstion, it starts with SSL, but after the client
sends some data and terminates the connection, the server comes back
with an SSH response in frame #15: SSH-2.0-DraySSH_2.0. Of course the
SSL dissector does not understand these bytes and marks them as
malformed (as the first bytes do not correspond to valid SSL record
layer version and length parameters).

Hope this helps,
Cheers,
     Sake