Wireshark · Wireshark-users: [Wireshark-users] Can't decrypt "snakeoil2" sample SSL session from wiki

[Grant Edwards <grant.b.edwards@xxxxxxxxx>]

I've been trying (and failing) to decrypt an SSL session using my
server and key.  So, I backed up a step and downloaded the
snakeoil2_070531.tgz sample file from the wiki:

  http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=snakeoil2_070531.tgz

I can't get that to decrypt either.

I've removed all the keys except the snakeoil one from the SSL
preferences.

When I select "Follow SSL Stream", the stream content window is always
empty.

 
Here are the specs on my wireshark: 

  $ wireshark -v
  wireshark 1.8.2 (SVN Rev Unknown from unknown)
  
  Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and
  contributors.
  This is free software; see the source for copying conditions. There is
  NO
  warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
  PURPOSE.
  
  Compiled (32-bit) with GTK+ 2.24.10, with Cairo 1.10.2, with Pango
  1.29.4, with
  GLib 2.30.3, with libpcap, with libz 1.2.5.1, with POSIX capabilities
  (Linux),
  without SMI, without c-ares, without ADNS, without Lua, without
  Python, with
  GnuTLS 2.12.18, with Gcrypt 1.5.0, without Kerberos, without GeoIP,
  without
  PortAudio, with AirPcap.
  
  Running on Linux 3.2.12-gentoogbe, without locale, with libpcap
  version 1.1.1,
  with libz 1.2.5.1, GnuTLS 2.12.18, Gcrypt 1.5.0, without AirPcap.
  
  Built using gcc 4.5.3.


Below is the ssl debug log that gets created when I run

 $ wireshark rsasnakeoil2.cap

One line that looks suspicious is where it says

 ssl_decrypt_pre_master_secret wrong pre_master_secret length (128, expected 48)

Any ideas on what's wrong?


-----------------------------ssldebug.log--------------------------------------
Private key imported: KeyID dd:29:74:15:7b:e6:76:47:f5:f0:68:3e:8a:55:61:62:...
ssl_init IPv4 addr '127.0.0.1' (127.0.0.1) port '443' filename '/home/grante/snakeoil/rsasnakeoil2.key' password(only for p12 file) ''
ssl_init private key file /home/grante/snakeoil/rsasnakeoil2.key successfully loaded.
association_add TCP port 443 protocol http handle 0x85bca00

dissect_ssl enter frame #4 (first time)
ssl_session_init: initializing ptr 0xa8afbc88 size 588
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 105
packet_from_server: is from server - FALSE
ssl_find_private_key server 127.0.0.1:443
client random len: 16 padded to 32
dissect_ssl2_hnd_client_hello found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #6 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 929
dissect_ssl3_record found version 0x0300 -> state 0x11
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 74, ssl state 0x11
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 70 bytes, remaining 79 
dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x17
dissect_ssl3_hnd_srv_hello trying to generate keys
ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
dissect_ssl3_hnd_srv_hello can't generate keyring material
  record: offset = 79, reported_length_remaining = 850
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 836, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 11 offset 84 length 832 bytes, remaining 920 
  record: offset = 920, reported_length_remaining = 9
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 4, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 14 offset 925 length 0 bytes, remaining 929 

dissect_ssl enter frame #8 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 212
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 132, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 16 offset 5 length 128 bytes, remaining 137 
pre master encrypted[128]:
65 51 2d a6 d4 a7 38 df ac 79 1f 0b d9 b2 61 7d 
73 88 32 d9 f2 62 3a 8b 11 04 75 ca 42 ff 4e d9 
cc b9 fa 86 f3 16 2f 09 73 51 66 aa 29 cd 80 61 
0f e8 13 ce 5b 8e 0a 23 f8 91 5e 5f 54 70 80 8e 
7b 28 ef b6 69 b2 59 85 74 98 e2 7e d8 cc 76 80 
e1 b6 45 4d c7 cd 84 ce b4 52 79 74 cd e6 d7 d1 
9c ad ef 63 6c 0f f7 05 e4 4d 1a d3 cb 9c d2 51 
b5 61 cb ff 7c ee c7 bc 5e 15 a3 f2 52 0f bb 32 
ssl_decrypt_pre_master_secret:RSA_private_decrypt
pcry_private_decrypt: stripping 0 bytes, decr_len 128
decrypted_unstrip_pre_master[128]:
5a 97 07 14 54 45 98 4e 3d 31 c4 b1 ec f0 4c 59 
45 20 40 77 0c ae 4e f8 9a f7 ea a6 e7 d2 45 92 
c5 22 f3 d5 d7 a7 0a 08 9d 3e 8c ec 2d 38 75 1b 
34 d3 36 0a 77 d4 e6 16 f9 4c b8 ad aa e3 64 5c 
fc 6c 0f bb 26 c2 96 33 09 33 ee 6f d6 83 66 b1 
a4 ea 20 fe 4a 74 61 93 f8 0e 70 7b 36 08 d1 ac 
75 a5 97 29 e0 95 14 be 81 0f 7e 8a d0 37 bc e4 
64 7b 7b 0c 9f 55 f3 0d ad eb ad cf 3c f6 c4 60 
ssl_decrypt_pre_master_secret wrong pre_master_secret length (128, expected 48)
dissect_ssl3_handshake can't decrypt pre master secret
  record: offset = 137, reported_length_remaining = 75
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
  record: offset = 143, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 169 offset 148 length 14210869 bytes, remaining 212 

dissect_ssl enter frame #9 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 75
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
  record: offset = 6, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 206 offset 11 length 8163907 bytes, remaining 75 

dissect_ssl enter frame #11 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 437
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 432, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #13 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 37
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 32, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 151 offset 5 length 12527303 bytes, remaining 37 

dissect_ssl enter frame #14 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 117
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 112, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 96 offset 5 length 11897077 bytes, remaining 117 

dissect_ssl enter frame #16 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 1007
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 96, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 120 offset 5 length 6760225 bytes, remaining 101 
  record: offset = 101, reported_length_remaining = 906
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 864, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 120 offset 106 length 6140009 bytes, remaining 970 
  record: offset = 970, reported_length_remaining = 37
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 32, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 216 offset 975 length 2186062 bytes, remaining 1007 

dissect_ssl enter frame #17 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 271
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 160, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 162 offset 5 length 13883118 bytes, remaining 165 
  record: offset = 165, reported_length_remaining = 106
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
  record: offset = 202, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 152 offset 207 length 10607033 bytes, remaining 271 

dissect_ssl enter frame #18 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 106
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
  record: offset = 37, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 112 offset 42 length 8754988 bytes, remaining 106 

dissect_ssl enter frame #19 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 5690
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 360, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 365, reported_length_remaining = 5325
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 5320, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #21 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 405
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 400, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #25 (first time)
ssl_session_init: initializing ptr 0xa8afd408 size 588
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 120
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 115, ssl state 0x00
association_find: TCP port 38714 found (nil)
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 1 offset 5 length 111 bytes, remaining 120 
packet_from_server: is from server - FALSE
ssl_find_private_key server 127.0.0.1:443
dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01

dissect_ssl enter frame #27 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 154
dissect_ssl3_record found version 0x0300 -> state 0x11
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 74, ssl state 0x11
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 70 bytes, remaining 79 
dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
ssl_restore_session can't find stored session
dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x17
dissect_ssl3_hnd_srv_hello trying to generate keys
ssl_generate_keyring_material not enough data to generate key (0x17 required 0x37 or 0x57)
dissect_ssl3_hnd_srv_hello can't generate keyring material
  record: offset = 79, reported_length_remaining = 75
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
  record: offset = 85, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 226 offset 90 length 5883402 bytes, remaining 154 

dissect_ssl enter frame #29 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 496
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
packet_from_server: is from server - FALSE
ssl_change_cipher CLIENT
  record: offset = 6, reported_length_remaining = 490
dissect_ssl3_record: content_type 22 Handshake
decrypt_ssl3_record: app_data len 64, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
dissect_ssl3_handshake iteration 1 type 73 offset 11 length 2248307 bytes, remaining 75 
  record: offset = 75, reported_length_remaining = 421
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 416, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38714 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #30 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 530
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 272, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 277, reported_length_remaining = 253
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 248, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #31 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 405
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 400, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38714 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #32 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 1762
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 344, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 349, reported_length_remaining = 1413
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 1408, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #35 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 522
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 272, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 277, reported_length_remaining = 245
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 240, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #36 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 373
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 368, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38714 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #37 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 514
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 272, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 277, reported_length_remaining = 237
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 232, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #40 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 445
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 440, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #42 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 578
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 312, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 317, reported_length_remaining = 261
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 256, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #44 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 445
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 440, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38714 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #45 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 402
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 352, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 357, reported_length_remaining = 45
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 40, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #47 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 445
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 440, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #48 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 770
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 256, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 261, reported_length_remaining = 509
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 504, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #50 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 413
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 408, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #51 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 413
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 408, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38714 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #52 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 586
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 336, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 341, reported_length_remaining = 245
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 240, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #54 (first time)
  conversation = 0xa8afcfe0, ssl_session = 0xa8afd408
  record: offset = 0, reported_length_remaining = 522
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 336, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 341, reported_length_remaining = 181
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 176, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #56 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 445
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 440, ssl state 0x17
packet_from_server: is from server - FALSE
decrypt_ssl3_record: using client decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #57 (first time)
  conversation = 0xa8afb860, ssl_session = 0xa8afbc88
  record: offset = 0, reported_length_remaining = 514
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 272, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390
  record: offset = 277, reported_length_remaining = 237
dissect_ssl3_record: content_type 23 Application Data
decrypt_ssl3_record: app_data len 232, ssl state 0x17
packet_from_server: is from server - TRUE
decrypt_ssl3_record: using server decoder
decrypt_ssl3_record: no decoder available
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #4 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 105

dissect_ssl enter frame #6 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 929
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 2 offset 5 length 70 bytes, remaining 79 
  record: offset = 79, reported_length_remaining = 850
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 11 offset 84 length 832 bytes, remaining 920 
  record: offset = 920, reported_length_remaining = 9
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 14 offset 925 length 0 bytes, remaining 929 

dissect_ssl enter frame #8 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 212
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 16 offset 5 length 128 bytes, remaining 137 
  record: offset = 137, reported_length_remaining = 75
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
  record: offset = 143, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 169 offset 148 length 14210869 bytes, remaining 212 

dissect_ssl enter frame #16 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 1007
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 120 offset 5 length 6760225 bytes, remaining 101 
  record: offset = 101, reported_length_remaining = 906
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 120 offset 106 length 6140009 bytes, remaining 970 
  record: offset = 970, reported_length_remaining = 37
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 216 offset 975 length 2186062 bytes, remaining 1007 

dissect_ssl enter frame #9 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 75
dissect_ssl3_record: content_type 20 Change Cipher Spec
dissect_ssl3_change_cipher_spec
  record: offset = 6, reported_length_remaining = 69
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 206 offset 11 length 8163907 bytes, remaining 75 

dissect_ssl enter frame #11 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 437
dissect_ssl3_record: content_type 23 Application Data
association_find: TCP port 38713 found (nil)
association_find: TCP port 443 found 0x8b4a390

dissect_ssl enter frame #13 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 37
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 151 offset 5 length 12527303 bytes, remaining 37 

dissect_ssl enter frame #14 (already visited)
  conversation = 0xa8afb860, ssl_session = (nil)
  record: offset = 0, reported_length_remaining = 117
dissect_ssl3_record: content_type 22 Handshake
dissect_ssl3_handshake iteration 1 type 96 offset 5 length 11897077 bytes, remaining 117 
--------------------------------------------------------------------------------