[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11670
Summary	Protocol SSL isn't really SSL
Product	Wireshark
Version	1.12.5
Hardware	x86
OS	Windows 7
Status	UNCONFIRMED
Severity	Major
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	jlou@doitt.nyc.gov

Build Information:
Paste the COMPLETE build information from "Help->About Wireshark", "wireshark
-v", or "tshark -v".
--
I have doing an analysis of IBM z/OS environment. I notice something very
strange. It seems that when I turn on decode to do SSL I get packets that are
indicated to be SSL/TLS but aren't.

I used NBA for Z/OS from Service Pilot to capture packets that I fed into
Wireshark.

The following shows a packet with SSL indicated:


No.     Time                          Source                Destination        
  Protocol Length Info
   1010 2015-11-02 11:51:40.668670000 10.217.10.76          10.190.0.65        
  SSL      953    Continuation Data

Frame 1010: 953 bytes on wire (7624 bits), 953 bytes captured (7624 bits)
    Encapsulation type: Ethernet (1)
    Arrival Time: Nov  2, 2015 11:51:40.668670000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1446483100.668670000 seconds
    [Time delta from previous captured frame: 0.000082000 seconds]
    [Time delta from previous displayed frame: 0.000082000 seconds]
    [Time since reference or first frame: 1.060650000 seconds]
    Frame Number: 1010
    Frame Length: 953 bytes (7624 bits)
    Capture Length: 953 bytes (7624 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:ssl]
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00
(00:00:00:00:00:00)
    Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)
        Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
        .... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
        Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
        .... ..0. .... .... .... .... = LG bit: Globally unique address
(factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.217.10.76 (10.217.10.76), Dst: 10.190.0.65
(10.190.0.65)
    Version: 4
    Header Length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT
(Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable
Transport) (0x00)
    Total Length: 939
    Identification: 0x91ff (37375)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 61
    Protocol: TCP (6)
    Header checksum: 0x882a [validation disabled]
        [Good: False]
        [Bad: False]
    Source: 10.217.10.76 (10.217.10.76)
    Destination: 10.190.0.65 (10.190.0.65)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 40193 (40193), Dst Port: 4043 (4043),
Seq: 16291, Ack: 134021, Len: 887
    Source Port: 40193 (40193)
    Destination Port: 4043 (4043)
    [Stream index: 3]
    [TCP Segment Len: 887]
    Sequence number: 16291    (relative sequence number)
    [Next sequence number: 17178    (relative sequence number)]
    Acknowledgment number: 134021    (relative ack number)
    Header Length: 32 bytes
    .... 0000 0001 1000 = Flags: 0x018 (PSH, ACK)
        000. .... .... = Reserved: Not set
        ...0 .... .... = Nonce: Not set
        .... 0... .... = Congestion Window Reduced (CWR): Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
    Window size value: 647
    [Calculated window size: 647]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x48dc [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    Urgent pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
        No-Operation (NOP)
            Type: 1
                0... .... = Copy on fragmentation: No
                .00. .... = Class: Control (0)
                ...0 0001 = Number: No-Operation (NOP) (1)
        No-Operation (NOP)
            Type: 1
                0... .... = Copy on fragmentation: No
                .00. .... = Class: Control (0)
                ...0 0001 = Number: No-Operation (NOP) (1)
        Timestamps: TSval 10956476, TSecr 675439395
            Kind: Time Stamp Option (8)
            Length: 10
            Timestamp value: 10956476
            Timestamp echo reply: 675439395
    [SEQ/ACK analysis]
        [Bytes in flight: 887]
Secure Sockets Layer

0000  00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00   ..............E.
0010  03 ab 91 ff 40 00 3d 06 88 2a 0a d9 0a 4c 0a be   ....@.=..*...L..
0020  00 41 9d 01 0f cb f8 fe 07 99 14 fd fe 3f 80 18   .A...........?..
0030  02 87 48 dc 00 00 01 01 08 0a 00 a7 2e bc 28 42   ..H...........(B
0040  63 23 00 00 03 77 45 42 43 46 00 00 20 00 01 00   c#...wEBCF.. ...
0050  00 01 31 35 4e 6f 76 20 32 2d 30 35 30 32 30 32   ..15Nov 2-050202
0060  2d 30 30 30 30 30 30 2d 30 31 31 54 57 53 80 01   -000000-011TWS..
0070  09 24 00 00 02 7c 00 00 00 24 00 00 00 00 00 00   .$...|...$......
0080  00 00 00 00 03 4b 03 00 00 00 00 00 00 00 00 00   .....K..........
0090  00 00 42 58 53 31 50 32 34 30 20 20 20 20 20 20   ..BXS1P240      
00a0  20 20 20 31 30 30 39 34 30 36 30 30 30 31 20 20      10094060001  
00b0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
00c0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
00d0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
00e0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
00f0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0100  20 20 20 20 20 20 20 20 30 30 30 32 34 30 30 34           00024004
0110  30 31 20 20 20 20 20 20 20 20 31 34 30 33 30 30   01        140300
0120  30 33 38 30 31 20 20 20 20 20 20 20 20 20 20 20   03801           
0130  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0140  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0150  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0160  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0170  20 20 31 32 20 20 20 20 20 20 20 20 20 20 20 20     12            
0180  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0190  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01a0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01b0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01c0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01d0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01e0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
01f0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0200  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0210  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0220  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0230  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0240  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0250  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0260  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0270  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0280  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
0290  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
02a0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
02b0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
02c0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
02d0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                   
02e0  20 20 20 20 20 20 20 20 20 20 2c 42 49 44 3d 6d             ,BID=m
02f0  76 73 70 2e 6e 79 63 6e 65 74 3a 34 30 34 33 2c   vsp.nycnet:4043,
0300  46 3d 53 45 4e 44 2c 55 49 44 3d 55 73 65 72 42   F=SEND,UID=UserB
0310  49 53 2c 43 49 44 3d 4e 4f 4e 45 2c 53 43 3d 50   IS,CID=NONE,SC=P
0320  38 31 30 41 2c 53 4e 3d 42 49 53 50 50 48 32 2c   810A,SN=BISPPH2,
0330  53 56 3d 42 49 53 57 45 42 53 45 52 56 49 43 45   SV=BISWEBSERVICE
0340  30 32 2c 57 3d 33 30 53 2c 53 4c 3d 36 30 30 2c   02,W=30S,SL=600,
0350  52 4c 3d 37 31 36 38 2c 4c 53 3d 41 53 43 49 49   RL=7168,LS=ASCII
0360  2c 41 50 49 3d 39 2c 58 52 4c 3d 30 2c 41 4e 4f   ,API=9,XRL=0,ANO
0370  44 45 3d 6d 74 70 6c 76 61 2d 64 6f 62 62 69 73   DE=mtplva-dobbis
0380  77 65 62 2c 41 54 59 50 45 3d 4a 61 76 61 2c 41   web,ATYPE=Java,A
0390  56 45 52 53 3d 38 2e 30 2e 30 2e 30 2c 41 4e 41   VERS=8.0.0.0,ANA
03a0  4d 45 3d 4a 61 76 61 20 52 75 6e 74 69 6d 65 2c   ME=Java Runtime,
03b0  45 54 58 4c 3d 32 35 36 2e                        ETXL=256.


Why would WIRESHARK think that the packet is SSL?

---

      You are receiving this mail because:

• You are watching all bug changes.