[Bug 9515] New: TLSV1 "Ignored Unknown Record"

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

Bug ID: 9515
Summary: TLSV1 "Ignored Unknown Record"
Classification: Unclassified
Product: Wireshark
Version: 1.10.3
Hardware: All
OS: Windows 7
Status: UNCONFIRMED
Severity: Normal
Priority: Low
Component: Wireshark
Assignee: bugzilla-***@wireshark.org
Reporter: ***@bordfamily.com

Build Information:
Version 1.10.0 (SVN Rev 49790 from /trunk-1.10)

Copyright 1998-2013 Gerald Combs <***@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.14, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.34.1, with WinPcap (4_1_3), with libz 1.2.5, without POSIX capabilities,
without libnl, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1, without Python,
with GnuTLS 2.12.18, with Gcrypt 1.4.6, without Kerberos, with GeoIP, with
PortAudio V19-devel (built Jun 5 2013), with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap.
Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz, with 3965MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219
--
As soon as an RSA key is used to decrypt 'STARTTLS traffic' the former SMTP
frames will be shown as "Ignored Unknown Record".

Loading Image...

Loading Image...

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

Alexis La Goutte <***@gmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@gmail.com

--- Comment #1 from Alexis La Goutte <***@gmail.com> ---
Hi,

It is possible to attach your sample ?

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

--- Comment #2 from ***@remontnetworks.com ---
only as screen shots

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

--- Comment #3 from Alexis La Goutte <***@gmail.com> ---
I will be complicated.

You have a option to set private pcap and only core-dev see the pcap

or it is possible to have tshark -V output ?

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

--- Comment #4 from Alexis La Goutte <***@gmail.com> ---
Any news ?

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

--- Comment #5 from ***@remontnetworks.com ---
Created attachment 12545
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=12545&action=edit
Key

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

--- Comment #6 from ***@remontnetworks.com ---
Created attachment 12546
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=12546&action=edit
capture

capture

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

Guy Harris <***@alum.mit.edu> changed:

What |Removed |Added
----------------------------------------------------------------------------
Component|GTK+ UI |Dissection engine
| |(libwireshark)

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

Daniël van Eeden <***@myname.nl> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |CONFIRMED
CC| |***@myname.nl
Ever confirmed|0 |1

--- Comment #7 from Daniël van Eeden <***@myname.nl> ---
This also happens with MySQL traffic. Wireshark tries to decode all packets as
SSL. As the initial MySQL handshake packets are not encrypted this will result
in "Ignored Unknown Record".

The solution could be this:
1. If the packet doesn't contain SSL records then try to decode the packet
directly as the protocol which should be within the SSL payload and/or the
protocol which we expect for this port.

2. Watch for a trigger (STARTTLS command or similar) and only try to decode
packets after this command.

[b***@wireshark.org]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9515

Alexis La Goutte <***@gmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|CONFIRMED |INCOMPLETE

--- Comment #8 from Alexis La Goutte <***@gmail.com> ---
(In reply to comment #6)

Created attachment 12546 [details]
capture
capture

Hi,

The capture is wrong, it is some HTTP traffic and no SMTP with STARTTLS..