Hi Mohamed,
Is it possible to share the stream (pcap) + keys? Alternatively, show the "Decrypted SSL" bytes in the request. The request is in frame 253, and something signals to the SSL/TLS dissector that the HTTP request is incomplete.
This could be a POST request where the request body is smaller than the specified Content-Length header, or for other reasons.
Kind regards,
Peter
https://lekensteyn.nl
(pardon my brevity, top-posting and formatting, sent from my phone)
On April 17, 2018 5:23:47 PM GMT+02:00, Mohamed Lrhazi <lrhazi@xxxxxxx> wrote:
>What would cause this issue... clearly decryption of traffic did work,
>since I can see the http response!
>
>Note that if I do "Follow SSL stream" I do see the http get request
>text
>just fine!
>
>I just updated to the latest, but still see same behavior. Version
>2.4.6
>(v2.4.6-0-ge2f395aa12)