summaryrefslogtreecommitdiff
path: root/tls/all/debug.txt
diff options
context:
space:
mode:
authorPeter Wu <lekensteyn@gmail.com>2013-09-14 23:13:48 +0200
committerPeter Wu <lekensteyn@gmail.com>2013-09-14 23:13:48 +0200
commitd697faf7ded0c279954dad247a02516b40f89347 (patch)
tree1edf06d3f4dce2951e9a00b7abca7b8a08053379 /tls/all/debug.txt
downloadwireshark-notes-d697faf7ded0c279954dad247a02516b40f89347.tar.gz
Initial commit of notes, dumps and scripts
Diffstat (limited to 'tls/all/debug.txt')
-rw-r--r--tls/all/debug.txt20504
1 files changed, 20504 insertions, 0 deletions
diff --git a/tls/all/debug.txt b/tls/all/debug.txt
new file mode 100644
index 0000000..668877e
--- /dev/null
+++ b/tls/all/debug.txt
@@ -0,0 +1,20504 @@
+Wireshark SSL debug log
+
+
+dissect_ssl enter frame #4 (first time)
+ssl_session_init: initializing ptr 0x7facc380f060 size 688
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 40165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4434
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #6 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session can't find stored session
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ cannot find master secret in keylog file either
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0003 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 52 11 00 00 00 00 00 00 |R....... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #8 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 118
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab...
+looking for RSA pre-masteraaf9896cd26391408e582a9fe4c1454d18e1935c79f420c9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f fd b7 80 db 61 46 f3 84 58 44 19 39 6c c0 1f |.....aF..XD.9l..|
+| bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c 52 34 bf |.f.K:.sF..b{\R4.|
+| 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 55 05 ec |.9.l...`. .H.U..|
+| e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |.....=...x.2. |
+hash out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+PRF out[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+key expansion[64]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+| b9 f7 1b 5e 87 bd 24 1f e8 5a 3a b1 41 12 b0 59 |...^..$..Z:.A..Y|
+| 20 5c 13 97 4d 9b 2b 47 f9 60 9c 41 a8 dd c3 8b | \..M.+G.`.A....|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 f7 1b 5e 87 |...^. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+PRF out[32]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+| 11 40 d4 b9 d1 f3 d9 a5 8c e7 8a 33 09 d3 86 40 |.@.........3...@|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| bd 24 1f e8 5a |.$..Z |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 1f 39 94 6c bb 0b fb 60 9d 20 7f 48 d6 |R4..9.l...`. .H.|
+| 55 05 ec e7 f9 a7 a3 ab 3d ae 14 bd 78 af 32 08 |U.......=...x.2.|
+| 52 34 bf 1f fd b7 80 db 61 46 f3 84 58 44 19 39 |R4......aF..XD.9|
+| 6c c0 1f bd 66 13 4b 3a 85 73 46 b1 b4 62 7b 5c |l...f.K:.sF..b{\|
+hash out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+PRF out[32]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+| 00 ee 94 bf a9 91 34 5e 45 4e ef 41 2e f8 68 11 |......4^EN.A..h.|
+Client MAC key[16]:
+| 84 8c 7a 20 e1 e3 81 4f be ee 23 5c e2 fc 0a a4 |..z ...O..#\....|
+Server MAC key[16]:
+| a9 3d 54 20 39 24 de 44 2a ef 9a 5f dc 0c be 47 |.=T 9$.D*.._...G|
+Client Write key[16]:
+| f9 f8 f5 03 39 4c e2 08 90 84 78 0d 7d 2c f4 14 |....9L....x.},..|
+Server Write key[16]:
+| 2e c2 9b f3 fa bb 6d 9e d8 cf 2f 2d ac 20 de 09 |......m.../-. ..|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ab 1f 53 b0 d4 2c d5 d9 3a d2 9d 10 94 17 c2 c7 |..S..,..:.......|
+| 8f 46 0e 99 0b 6e eb a6 95 9e 9d 41 31 7a b5 71 |.F...n.....A1z.q|
+Plaintext[32]:
+| 14 00 00 0c 5d c6 d2 8c 1a 80 f1 2e fb 70 e7 68 |....]........p.h|
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 91 a5 3e 01 f9 26 3e 50 36 b9 36 40 e6 c0 a1 1e |..>..&>P6.6@....|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #9 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7b 0f 3a 4f 01 75 7f c4 33 6f 0a bc a6 a2 50 67 |{.:O.u..3o....Pg|
+| a4 c8 58 70 89 81 ed 24 6d 43 34 8c 9c ca 15 e0 |..Xp...$mC4.....|
+Plaintext[32]:
+| 14 00 00 0c 0b 09 b9 f9 94 8b 80 5f e6 42 81 6b |..........._.B.k|
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 88 89 9f 61 5e 5e f2 c5 c2 78 01 dd 25 ca 1d a0 |...a^^...x..%...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #10 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 3e 0d ba 3e 4a 7e 7a 46 bf b9 9c 3f 31 f8 b2 0f |>..>J~zF...?1...|
+| 69 64 7c 7a 30 22 ce 38 45 4b 81 31 00 a9 41 57 |id|z0".8EK.1..AW|
+| b4 dd 58 41 f0 0e 11 23 4b 29 44 47 46 73 b3 7f |..XA...#K)DGFs..|
+| ed 45 37 c9 3b 0c 33 4f 55 54 f0 21 c1 05 0b 19 |.E7.;.3OUT.!....|
+| 9a be 8f 5d c4 70 c9 60 74 b0 94 5b 23 ee 84 a6 |...].p.`t..[#...|
+| 48 |H |
+ssl_decrypt_record: allocating 113 bytes for decrypt data (old len 32)
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 |.C"..-........N.|
+| 2f |/ |
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 43 22 01 05 2d d1 83 ca ea 87 04 a4 fa 4e f2 2f |C"..-........N./|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 65, seq = 0, nxtseq = 65
+association_find: TCP port 40165 found (nil)
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 65
+decrypted app data fragment[65]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 65 78 70 2d 72 63 34 2d 6d 64 |Host: exp-rc4-md|
+| 35 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |5.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 33 34 0d 0a 0d |steyn.nl:4434...|
+| 0a |. |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #11 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 376
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 371, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 371
+Ciphertext[371]:
+| b6 de 1f 5a df ae ce 3e 4a 6e 21 25 a2 47 06 25 |...Z...>Jn!%.G.%|
+| f6 fd bb 49 e7 a4 6a bc 89 32 6f 22 14 eb 8f 3e |...I..j..2o"...>|
+| 05 bc d5 bf df b2 19 7b 64 fa 62 c5 96 15 7b 0a |.......{d.b...{.|
+| a6 50 cd d2 4c 3f 5c 2b 20 fc 8b d4 d9 2b db 99 |.P..L?\+ ....+..|
+| e4 14 36 ec 8d dd 42 74 20 e6 fa c6 34 1a d1 b6 |..6...Bt ...4...|
+| 2d 74 a1 00 7b 11 e2 a8 70 f1 96 63 32 0b 44 4f |-t..{...p..c2.DO|
+| b1 45 25 70 71 74 95 28 7f 55 5b e4 f3 39 df 53 |.E%pqt.(.U[..9.S|
+| 14 e4 5a 3a 43 f5 9d 0b 9d ad 81 ff 06 fe 57 eb |..Z:C.........W.|
+| f0 b9 e1 c9 14 45 1c 55 7b 26 da 08 6d a1 0b 71 |.....E.U{&..m..q|
+| a1 60 e9 c3 2e a1 a3 89 58 5e 21 6a 17 98 2d dd |.`......X^!j..-.|
+| b4 09 e8 af 88 2b 58 f1 66 23 38 95 f3 32 ad 59 |.....+X.f#8..2.Y|
+| 62 cf cb fc c3 84 fd 33 5a 45 5e 61 28 10 f3 2c |b......3ZE^a(..,|
+| 69 73 af 99 37 44 55 ab 1f 1d 17 be 38 cb f0 6b |is..7DU.....8..k|
+| 79 ea bf 8f 80 d4 49 6b 20 2c 57 c9 b1 48 d7 7a |y.....Ik ,W..H.z|
+| f9 f2 4a 56 cd 68 20 34 d9 47 27 fe 00 6b 19 07 |..JV.h 4.G'..k..|
+| 2c 55 ac 38 35 b1 98 e9 bb 02 ed ab 01 c9 38 2c |,U.85.........8,|
+| 87 2e b0 da d3 7d 5b 39 07 cb fb f3 6d 95 91 9c |.....}[9....m...|
+| 84 92 90 3c 34 7f ed aa 7e 22 e9 99 a5 b4 90 7b |...<4...~".....{|
+| 61 f9 6b 96 b7 3c a8 27 76 e6 87 35 d4 f9 67 67 |a.k..<.'v..5..gg|
+| f2 64 bb e3 6e a9 12 ab 42 e3 ca 14 90 44 c2 e6 |.d..n...B....D..|
+| 76 ad e2 f6 17 af a7 68 fd b0 21 95 f2 bb d6 b6 |v......h..!.....|
+| e2 fb 59 af 27 31 d9 f1 4d 2f fb d8 d8 b3 06 48 |..Y.'1..M/.....H|
+| ab 1a af 4d a3 79 58 19 a9 42 ce c2 e0 c1 bd 83 |...M.yX..B......|
+| dc 58 e3 |.X. |
+ssl_decrypt_record: allocating 403 bytes for decrypt data (old len 113)
+Plaintext[371]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d |pt>....;D..f..G-|
+| dd 1e eb |... |
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0d a2 e5 83 3b 44 dd 1f 66 9a cf 47 2d dd 1e eb |....;D..f..G-...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 355, seq = 0, nxtseq = 355
+association_find: TCP port 4434 found 0x33f9600
+dissect_ssl3_record decrypted len 355
+decrypted app data fragment[355]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 38 0d 0a 43 6f 6e 6e 65 63 74 |th: 148..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 33 20 2d 20 45 58 50 2d 52 |x00,0x03 - EXP-R|
+| 43 34 2d 4d 44 35 20 20 20 20 20 20 20 20 20 20 |C4-MD5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 28 | SSLv3 Kx=RSA(|
+| 35 31 32 29 20 41 75 3d 52 53 41 20 20 45 6e 63 |512) Au=RSA Enc|
+| 3d 52 43 34 28 34 30 29 20 20 20 4d 61 63 3d 4d |=RC4(40) Mac=M|
+| 44 35 20 20 65 78 70 6f 72 74 3c 73 63 72 69 70 |D5 export<scrip|
+| 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 |t>document.domai|
+| 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |n='local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 |nsteyn.nl'</scri|
+| 70 74 3e |pt> |
+dissect_ssl3_record found association 0x33f9600
+
+dissect_ssl enter frame #12 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 35 00 7c 44 00 05 fc 63 be 79 45 3f d5 59 a6 77 |5.|D...c.yE?.Y.w|
+| a4 7a |.z |
+Plaintext[18]:
+| 01 00 e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 |...a4...U.....R.|
+| 8f b2 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| e5 61 34 97 13 16 55 c7 94 c8 99 8e 52 f3 8f b2 |.a4...U.....R...|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #14 (first time)
+ conversation = 0x7facef996088, ssl_session = 0x7facc380f060
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| f9 ee 0f 6c 4b 2e f9 71 f6 c7 eb d5 b4 cb 78 2a |...lK..q......x*|
+| c7 a3 |.. |
+Plaintext[18]:
+| 01 00 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 |..{[..3^...+..ZX|
+| 1d a0 |.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 7b 5b fa 88 33 5e a9 f5 a1 2b 80 f8 5a 58 1d a0 |{[..3^...+..ZX..|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #19 (first time)
+ssl_session_init: initializing ptr 0x7facc38119d0 size 688
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46195 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4435
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #21 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0004 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6f d8 d0 b4 a1 99 96 05 3c ac 68 66 95 39 c4 82 |o.......<.hf.9..|
+| a6 0f cf d3 2d 89 14 f9 61 da 94 ea 47 73 d9 c8 |....-...a...Gs..|
+| 8e 25 b0 97 4b 5c c3 18 a4 b3 ff 4d c7 74 0f 67 |.%..K\.....M.t.g|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+PRF out[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+key expansion[64]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client MAC key[16]:
+| 4d 58 fa 76 c6 fa be b0 3c bc 17 b6 fb 33 03 73 |MX.v....<....3.s|
+Server MAC key[16]:
+| 68 ff a0 a9 84 f6 55 62 42 9b 83 80 f9 01 be 91 |h.....UbB.......|
+Client Write key[16]:
+| 32 fd 0d af 1e f6 86 88 f1 5a 06 2d 5b d3 da b1 |2........Z.-[...|
+Server Write key[16]:
+| 0f 15 23 6d 77 18 6e 1f 5e 01 d8 98 4a 0d b4 db |..#mw.n.^...J...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #23 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 310
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364e...
+looking for RSA pre-master808f0a3961b6859682b36eb63335dbdfe3e0ea7aa788787e...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 3a f5 89 bb b8 2b 3e a5 ed 30 dd 0d ec 14 7b |.:....+>..0....{|
+| 27 ae 1a 68 58 a9 ce a1 dc a5 ce bb 6a 52 34 bf |'..hX.......jR4.|
+| 1f 04 e5 5e f5 0c cc eb 09 8b f3 65 9b ac 1f 85 |...^.......e....|
+| 0e 9e da 36 4e bb d9 b5 c7 7d ab 03 ac |...6N....}... |
+hash out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+PRF out[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+key expansion[64]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client MAC key[16]:
+| ac 46 7e 11 24 8b 6a 8d b5 b4 ba 60 65 ad fb f5 |.F~.$.j....`e...|
+Server MAC key[16]:
+| aa 89 92 1f 82 63 e8 05 29 a3 a7 58 06 12 ba ed |.....c..)..X....|
+Client Write key[16]:
+| d9 58 1d 87 d5 e0 39 1c b4 c1 50 86 10 89 8c ce |.X....9...P.....|
+Server Write key[16]:
+| 2d 4b 94 fc b8 3b 51 ca 24 39 55 e1 1c 98 3c fb |-K...;Q.$9U...<.|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 40 bd 73 03 00 00 00 00 |@.s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 16)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| e8 4a 32 ba 83 bb c0 cd 12 c5 82 7e f5 d4 95 6d |.J2........~...m|
+| 72 f4 32 fd e4 31 29 10 48 6a 07 2f 47 77 04 94 |r.2..1).Hj./Gw..|
+Plaintext[32]:
+| 14 00 00 0c c8 4b 0b 55 9f 72 f5 13 a3 e9 69 bf |.....K.U.r....i.|
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 68 fa 37 4c 33 c0 84 93 2d 9a 1f 1b 17 99 2e 69 |h.7L3...-......i|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #24 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 218
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 43
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 37
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 44 03 b0 93 8e 51 2a 28 92 af d6 37 31 c9 4c 90 |D....Q*(...71.L.|
+| dc be 73 5e 73 74 bd ca 03 c8 ad 34 08 23 1c b4 |..s^st.....4.#..|
+Plaintext[32]:
+| 14 00 00 0c 18 0b 80 a3 9b d5 02 4c 96 a6 a1 65 |...........L...e|
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 2d 4c 2b 2a 1a 7d ec 1b a4 cf 88 ba 6b d1 88 c3 |-L+*.}......k...|
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #25 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 82
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 77, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 77
+Ciphertext[77]:
+| 60 6f e0 5f f0 8a 20 20 46 e7 f5 44 f8 57 c7 1d |`o._.. F..D.W..|
+| 00 82 b8 12 b4 3f 78 97 43 ef ac be dd 6a 76 29 |.....?x.C....jv)|
+| cb 31 5b 62 64 70 ed 86 fc 60 5c dd f3 8b d5 c0 |.1[bdp...`\.....|
+| 38 61 b7 a7 df be 5d 3a 30 66 19 54 be 3c 35 cd |8a....]:0f.T.<5.|
+| 14 27 47 24 73 56 61 84 0e 42 9c e5 5f |.'G$sVa..B.._ |
+Plaintext[77]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a 21 89 fe |n.nl:4435....!..|
+| cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |....!o...F... |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 21 89 fe cc b4 9d bb 21 6f e7 c1 ec 46 98 bc 0a |!......!o...F...|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 46195 found (nil)
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 6d 64 35 2e 6c 6f |Host: rc4-md5.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 35 0d 0a 0d 0a |n.nl:4435.... |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #26 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 368
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 363, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 363
+Ciphertext[363]:
+| e5 44 fb 83 4b 56 20 00 62 db a3 09 c9 55 30 0b |.D..KV .b....U0.|
+| 9e 0c 85 05 a6 a4 47 92 3a 04 7d 8c bc 71 1e 1c |......G.:.}..q..|
+| 6d a8 a6 40 d3 a6 42 64 e0 ea c7 b5 a9 92 dd 31 |m..@..Bd.......1|
+| fc 75 04 55 f1 24 8d 54 44 3e 8a f1 0f a6 8d a1 |.u.U.$.TD>......|
+| bb e1 20 7c 2e ee 89 5f 88 5c 9f 2c 41 ea b3 92 |.. |..._.\.,A...|
+| c1 99 6f 92 d2 ca 7b 66 3e bd f3 ce 94 1c 0e 20 |..o...{f>...... |
+| 03 75 48 62 b7 98 1c 70 fd 8c 66 80 ff 5d 91 c6 |.uHb...p..f..]..|
+| 39 9a 42 b8 92 bc 6c 97 bc 77 92 37 01 c5 24 59 |9.B...l..w.7..$Y|
+| 85 0b f1 a0 89 1e 46 53 58 6e f4 64 54 47 87 77 |......FSXn.dTG.w|
+| c7 eb f7 16 40 18 74 44 98 69 d3 49 cf b0 9a 83 |....@.tD.i.I....|
+| 86 b4 a0 46 c6 42 ce ee f0 f5 fb c2 47 19 d3 01 |...F.B......G...|
+| ce 90 3c ac 4a e1 82 f4 19 81 7c b8 dc db a5 34 |..<.J.....|....4|
+| 3c ac 6c 98 db 64 b1 8f 7e 8d 45 64 99 1e b7 c3 |<.l..d..~.Ed....|
+| 16 50 2c 09 57 61 d3 aa e8 f9 bd a2 cd 65 d1 1f |.P,.Wa.......e..|
+| d2 6c 3b f7 6c 57 2c 3c 9e 85 95 4b e9 b4 54 ee |.l;.lW,<...K..T.|
+| ba 85 bc 7e 92 dc 85 54 86 db ef b0 bd 76 2a d6 |...~...T.....v*.|
+| 8f d3 4a f0 e0 a9 ba 89 24 3d 6b 71 c1 31 7e 91 |..J.....$=kq.1~.|
+| c3 3e e1 4a da 23 5a 0a 2a 82 15 85 b0 b1 0e f0 |.>.J.#Z.*.......|
+| 64 88 a1 75 ad 0a 9c 9c b1 ab 12 a8 90 38 69 a9 |d..u.........8i.|
+| fd 3e cb 85 45 a1 32 42 fd ba 77 f7 53 74 f8 17 |.>..E.2B..w.St..|
+| ca 5f d6 d8 f8 99 99 85 47 14 e6 cd 4f 0f 76 d5 |._......G...O.v.|
+| 1d bc 93 22 53 75 56 a2 34 0f ed 53 d7 2b a5 27 |..."SuV.4..S.+.'|
+| 6a 17 c8 e0 f7 04 2a 86 da c3 33 |j.....*...3 |
+Plaintext[363]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 14 32 51 46 1a |l'</script>.2QF.|
+| 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |^s......a.. |
+checking mac (len 347, version 303, ct 23 seq 1)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 14 32 51 46 1a 5e 73 d7 0d e3 e0 8c d5 61 f6 f4 |.2QF.^s......a..|
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 347, seq = 0, nxtseq = 347
+association_find: TCP port 4435 found 0x34254c0
+dissect_ssl3_record decrypted len 347
+decrypted app data fragment[347]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 30 0d 0a 43 6f 6e 6e 65 63 74 |th: 140..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 34 20 2d 20 52 43 34 2d 4d |x00,0x04 - RC4-M|
+| 44 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |D5 |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 4d |=RC4(128) Mac=M|
+| 44 35 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |D5<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e |l'</script> |
+dissect_ssl3_record found association 0x34254c0
+
+dissect_ssl enter frame #27 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| fa 16 da a9 91 b0 7c 04 81 10 a2 25 50 28 d2 07 |......|....%P(..|
+| ac 34 |.4 |
+Plaintext[18]:
+| 01 00 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 |.......B...8.np.|
+| 34 a4 |4. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 1a aa f5 db ef 42 e3 ab 17 38 f7 6e 70 92 34 a4 |.....B...8.np.4.|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #29 (first time)
+ conversation = 0x7facef9963d8, ssl_session = 0x7facc38119d0
+ record: offset = 0, reported_length_remaining = 23
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 18, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 18
+Ciphertext[18]:
+| 69 b5 40 b5 50 76 16 cc 5b 06 0d 7f c4 24 6b 1a |i.@.Pv..[....$k.|
+| dc 72 |.r |
+Plaintext[18]:
+| 01 00 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 |...%5n......#..b|
+| c0 36 |.6 |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:MD5 md 1
+Mac[16]:
+| 0f 25 35 6e b2 cf 16 93 94 d0 23 87 f3 62 c0 36 |.%5n......#..b.6|
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #34 (first time)
+ssl_session_init: initializing ptr 0x7facc3814390 size 688
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52548 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4436
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #36 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0005 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a0 49 fb 93 a7 82 0f 54 75 aa a1 e1 a4 8f b3 4b |.I.....Tu......K|
+| eb 28 a6 0d 3d aa eb 97 4a 0c e4 b7 39 eb 5a 8f |.(..=...J...9.Z.|
+| e0 5c f8 4b ed 98 7d b3 aa 4c 44 9d 67 2b b3 bc |.\.K..}..LD.g+..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+PRF out[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+key expansion[72]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 d0 96 ab db 02 a7 a3 67 a8 24 dc ce |dt.........g.$..|
+| b7 9c 03 1f ad 04 25 e2 d9 28 da 0a 59 18 53 a3 |......%..(..Y.S.|
+| a6 21 54 e0 c0 6b 63 4a 79 96 6d 4a 8e 13 7a 38 |.!T..kcJy.mJ..z8|
+| d1 4c fd 88 3a ba 89 16 |.L..:... |
+Client MAC key[20]:
+| 7d 35 00 74 f4 d1 5e b9 4f b6 f1 cc b5 ef 97 db |}5.t..^.O.......|
+| 64 74 c4 d0 |dt.. |
+Server MAC key[20]:
+| d0 96 ab db 02 a7 a3 67 a8 24 dc ce b7 9c 03 1f |.......g.$......|
+| ad 04 25 e2 |..%. |
+Client Write key[16]:
+| d9 28 da 0a 59 18 53 a3 a6 21 54 e0 c0 6b 63 4a |.(..Y.S..!T..kcJ|
+Server Write key[16]:
+| 79 96 6d 4a 8e 13 7a 38 d1 4c fd 88 3a ba 89 16 |y.mJ..z8.L..:...|
+Client Write IV[8]:
+| 01 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 10 00 00 00 00 00 00 00 |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #38 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 314
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c...
+looking for RSA pre-masterb6af8c30c49aaae7d853096e912562724f72c45dc8a26642...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 1f 7d ed 32 19 50 18 7c 63 a3 14 53 53 50 07 85 |.}.2.P.|c..SSP..|
+| da ec b8 67 de ea 38 ad 61 71 fa 73 07 52 34 bf |...g..8.aq.s.R4.|
+| 1f 4f f7 89 84 11 88 84 23 d1 f6 01 ae 6c 17 7a |.O......#....l.z|
+| 9a b4 89 8e 3c 4e ed 7e fe 45 c4 39 f3 |....<N.~.E.9. |
+hash out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+PRF out[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+key expansion[72]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b d4 d8 49 cf e1 14 5a c8 86 34 05 3c |..|{..I...Z..4.<|
+| f5 e5 b7 ff f5 e9 9e c8 ad 1d f6 13 87 b3 cd 7c |...............||
+| 8c c2 8a f2 51 d5 9d 09 5a 07 8f c9 cf 20 ab f2 |....Q...Z.... ..|
+| 41 6e 17 77 ac d9 cf c2 |An.w.... |
+Client MAC key[20]:
+| a8 29 ce 66 d8 ce e6 f0 2a 7f b2 5b b0 85 02 b3 |.).f....*..[....|
+| ee 1b 7c 7b |..|{ |
+Server MAC key[20]:
+| d4 d8 49 cf e1 14 5a c8 86 34 05 3c f5 e5 b7 ff |..I...Z..4.<....|
+| f5 e9 9e c8 |.... |
+Client Write key[16]:
+| ad 1d f6 13 87 b3 cd 7c 8c c2 8a f2 51 d5 9d 09 |.......|....Q...|
+Server Write key[16]:
+| 5a 07 8f c9 cf 20 ab f2 41 6e 17 77 ac d9 cf c2 |Z.... ..An.w....|
+Client Write IV[8]:
+| 00 00 00 00 00 00 00 00 |........ |
+Server Write IV[8]:
+| 20 bb 73 03 00 00 00 00 | .s..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: ARCFOUR
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 48 c5 28 a0 67 ce 6f 73 b3 ca 86 90 1d 1d 9c f2 |H.(.g.os........|
+| 6b f6 8a 52 24 31 22 e7 4e 2c 38 ad e6 85 ca 9c |k..R$1".N,8.....|
+| 2f f8 1d ec |/... |
+Plaintext[36]:
+| 14 00 00 0c 5e 22 3c 93 0e 06 30 b7 48 68 6e 8f |....^"<...0.Hhn.|
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 99 76 9c fe af 82 ba 9d 4c c6 9c d7 92 dd de |%.v......L......|
+| 27 e9 ad 2a |'..* |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #39 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 222
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 47
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 41
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 36, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 36
+Ciphertext[36]:
+| 51 e6 e8 5e 4e 01 4d a8 2b 86 6b 7f fa ca e4 3f |Q..^N.M.+.k....?|
+| da bf d5 17 d4 ac 4c 6a 18 86 4c a0 02 00 86 5b |......Lj..L....[|
+| 60 ac 83 bd |`... |
+Plaintext[36]:
+| 14 00 00 0c 26 b7 15 da 6e e8 de 93 82 69 0a a0 |....&...n....i..|
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 92 ff 7b 6f fa 21 23 6f e4 ec e9 ac 44 4c 37 ca |..{o.!#o....DL7.|
+| 18 4a 67 b4 |.Jg. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #40 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 86
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 81, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 81
+Ciphertext[81]:
+| 71 8c 78 49 55 b2 7d d0 54 53 7b 45 da a7 14 4c |q.xIU.}.TS{E...L|
+| d2 d6 43 63 a1 02 3c 1e 36 6f 1d 7d 70 c3 7c 76 |..Cc..<.6o.}p.|v|
+| aa 80 ea f4 59 b9 b4 88 09 ad d6 5d f4 37 5e b8 |....Y......].7^.|
+| 93 4b 36 e3 c6 89 4b 7d b4 ea 25 9a a6 31 e2 64 |.K6...K}..%..1.d|
+| 6a 26 ec 66 7d e0 ab ed 81 15 7e c7 22 4f 33 b5 |j&.f}.....~."O3.|
+| f5 |. |
+Plaintext[81]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a 4e ef 09 |n.nl:4436....N..|
+| 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 7a 9b b9 |........'..h.z..|
+| 69 |i |
+checking mac (len 61, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e ef 09 10 a3 0c b7 a7 18 03 12 27 05 de 68 e4 |N..........'..h.|
+| 7a 9b b9 69 |z..i |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 61, seq = 0, nxtseq = 61
+association_find: TCP port 52548 found (nil)
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 61
+decrypted app data fragment[61]:
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 72 63 34 2d 73 68 61 2e 6c 6f |Host: rc4-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 36 0d 0a 0d 0a |n.nl:4436.... |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #41 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 373
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 368, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 368
+Ciphertext[368]:
+| dd 76 6d d3 37 22 56 3b 8d e8 d7 8a d0 8d e8 d4 |.vm.7"V;........|
+| a6 9b b1 dd 3f 5f cf 57 37 84 23 1f da 94 d7 b8 |....?_.W7.#.....|
+| aa 25 8e 2b cf a4 58 5a 15 9c de dc 39 78 c6 c8 |.%.+..XZ....9x..|
+| 43 1b a8 2d 41 8d 42 1f 19 e1 da 12 e8 82 2d e1 |C..-A.B.......-.|
+| b6 c3 25 5e c4 55 3b 3f d3 4e 07 10 7e bb df 5d |..%^.U;?.N..~..]|
+| 69 70 5e 5a ed 24 92 e4 9e e3 2f 75 ac 6d 44 26 |ip^Z.$..../u.mD&|
+| f2 f0 95 fc 5a f8 ca 96 d7 11 7e 93 eb 23 1d 7a |....Z.....~..#.z|
+| b1 20 12 8e c6 13 5e b9 11 b0 ea 22 67 58 2c 04 |. ....^...."gX,.|
+| 09 07 3b 27 c6 c1 06 0e 89 93 c1 a9 2e af ca 3d |..;'...........=|
+| dc ee 57 82 a1 fd 71 33 07 3a 4a fb d0 88 1f 65 |..W...q3.:J....e|
+| 45 8c 62 b3 c1 5e 50 37 24 12 4e e7 59 a8 8e 23 |E.b..^P7$.N.Y..#|
+| c8 b8 37 01 43 7a f6 a9 c8 c7 0f aa b5 f9 f9 e6 |..7.Cz..........|
+| a7 65 b5 e7 bb 58 79 12 b1 07 08 df ee c1 52 96 |.e...Xy.......R.|
+| 3a af a3 c3 42 9f fd 0b 00 5b fc 4e 9b 36 41 15 |:...B....[.N.6A.|
+| bf d6 15 1e bf d3 bc 17 d2 e6 cb 50 2a 3e 14 1d |...........P*>..|
+| c2 f3 17 f7 24 52 a7 e5 34 fc 60 d5 6d dd 4f 14 |....$R..4.`.m.O.|
+| 59 cc 1b 0f f1 56 b1 0c 86 d6 8e 87 86 11 03 25 |Y....V.........%|
+| 82 92 c5 4a 93 cc 21 d4 d0 19 30 87 89 4c 43 26 |...J..!...0..LC&|
+| 95 3d 7e 3e c9 55 f7 51 f4 53 44 68 07 73 d2 91 |.=~>.U.Q.SDh.s..|
+| 98 c3 6a 70 eb dc ba 10 69 a6 5d 67 8a 94 8e 4b |..jp....i.]g...K|
+| eb 5c ff 7d 42 5b a3 e6 e2 ca bd 93 ee c4 63 86 |.\.}B[........c.|
+| 54 c7 32 94 38 72 e2 74 13 d6 af 28 df 08 a8 b3 |T.2.8r.t...(....|
+| 4c c2 ae 34 65 c5 4d 57 82 84 79 ed a4 73 ec 70 |L..4e.MW..y..s.p|
+Plaintext[368]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d9 c6 84 44 |nl'</script>...D|
+| d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d bf e3 39 c6 |..j.RM. .-.-..9.|
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d9 c6 84 44 d3 dc 6a bc 52 4d 8e 20 1b 2d f3 2d |...D..j.RM. .-.-|
+| bf e3 39 c6 |..9. |
+ssl_decrypt_record: mac ok
+ssl_add_data_info: new data inserted data_len = 348, seq = 0, nxtseq = 348
+association_find: TCP port 4436 found 0x342d9a0
+dissect_ssl3_record decrypted len 348
+decrypted app data fragment[348]:
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:11 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 30 35 20 2d 20 52 43 34 2d 53 |x00,0x05 - RC4-S|
+| 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |HA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 52 43 34 28 31 32 38 29 20 20 4d 61 63 3d 53 |=RC4(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |nl'</script> |
+dissect_ssl3_record found association 0x342d9a0
+
+dissect_ssl enter frame #42 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| c3 a9 02 80 e9 7a a0 63 1f a4 c7 42 9e c7 dc 1f |.....z.c...B....|
+| d5 55 d1 72 c5 f9 |.U.r.. |
+Plaintext[22]:
+| 01 00 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 |...d...F.....].V|
+| d0 da 1c 60 1c 1c |...`.. |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9b 64 97 83 c3 46 fb 9f 07 97 a0 5d 88 56 d0 da |.d...F.....].V..|
+| 1c 60 1c 1c |.`.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #44 (first time)
+ conversation = 0x7facef996728, ssl_session = 0x7facc3814390
+ record: offset = 0, reported_length_remaining = 27
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 22, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 22
+Ciphertext[22]:
+| 5b d4 68 03 7d 40 b8 58 7d ab 4d 7c f6 23 5a e4 |[.h.}@.X}.M|.#Z.|
+| 6e e1 65 3d d7 39 |n.e=.9 |
+Plaintext[22]:
+| 01 00 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e |..k.%%..k....`.N|
+| 77 1d 22 f9 26 74 |w.".&t |
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6b df 25 25 c9 a3 6b 1f d0 02 d3 60 14 4e 77 1d |k.%%..k....`.Nw.|
+| 22 f9 26 74 |".&t |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #49 (first time)
+ssl_session_init: initializing ptr 0x7facc3816d50 size 688
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 43026 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4437
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #51 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0006 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+PRF out[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+key expansion[88]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 0d f7 7c aa cf a0 16 1b e7 db af 5c |...G..|........\|
+| d5 2e 93 4b 06 19 5b 82 18 80 94 6b 52 9f e0 4c |...K..[....kR..L|
+| dc 83 1a 26 41 4f f0 50 25 4d b9 c9 e9 76 18 88 |...&AO.P%M...v..|
+| eb ab cd 1e 20 75 76 36 c6 15 70 29 1f ba 38 a2 |.... uv6..p)..8.|
+| 76 54 dc ae f4 3d f3 91 |vT...=.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 18 80 94 6b 52 |...kR |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+PRF out[32]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+| 62 a7 d9 a7 d1 88 82 23 3f bc 66 bb f7 1d 8b ff |b......#?.f.....|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 9f e0 4c dc 83 |..L.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+PRF out[32]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+| 54 81 7e de de 29 6f 9d 73 3d 22 6f a7 1f 99 11 |T.~..)o.s="o....|
+Client MAC key[20]:
+| 91 8d 77 e8 85 cf 07 59 26 93 70 95 9d 3b 73 57 |..w....Y&.p..;sW|
+| b1 04 9c 47 |...G |
+Server MAC key[20]:
+| 0d f7 7c aa cf a0 16 1b e7 db af 5c d5 2e 93 4b |..|........\...K|
+| 06 19 5b 82 |..[. |
+Client Write key[16]:
+| 64 aa b3 91 c0 a1 9b 3f ba c5 49 55 ba 47 ec 81 |d......?..IU.G..|
+Server Write key[16]:
+| 09 15 8d ab 03 df 8c 6c 57 d4 c7 c2 14 c9 5d d8 |.......lW.....].|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_hnd_srv_hello can't generate keyring material
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #53 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8...
+looking for RSA pre-master79a1d2e1fa7136af7a5de4145176273ffdbedd17620baa6d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 0e b9 e2 59 80 8e 59 22 37 ec 51 b4 96 7b 67 ef |...Y..Y"7.Q..{g.|
+| 3b 18 f9 48 c1 b4 0d 7f 78 e3 70 15 49 4c 99 d9 |;..H....x.p.IL..|
+| 51 09 01 5c 42 ee 03 6d d5 9f 0a c4 5b 16 79 d8 |Q..\B..m....[.y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 3e e5 56 | ....=9%...j.>.V|
+| f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 52 34 bf |...J..VI...?.R4.|
+| 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 aa 46 fb | ..UCc.BvE....F.|
+| 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |B>.1....21q.. |
+hash out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+PRF out[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+key expansion[88]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 ff 51 b2 15 12 44 b2 ea 56 96 32 4f |...&.Q...D..V.2O|
+| f4 1d 64 80 18 30 43 d7 73 03 5d 6b 6d 4d 3d 4f |..d..0C.s.]kmM=O|
+| 82 10 1c 71 14 6a 59 b8 34 65 7a c3 ce 2f 3b 8c |...q.jY.4ez../;.|
+| 9e 29 6a 11 bf 0f 0c c9 f2 7a 10 a4 58 f2 27 aa |.)j......z..X.'.|
+| 9c a2 bb 59 ef 54 66 27 |...Y.Tf' |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 a9 15 55 43 |IV blockR4. ..UC|
+| 63 f9 42 76 45 02 b6 d1 aa 46 fb 42 3e a2 31 f8 |c.BvE....F.B>.1.|
+| e1 0e aa 32 31 71 ad c4 52 34 bf 20 ec c6 05 ca |...21q..R4. ....|
+| 3d 39 25 c8 c1 16 6a b2 3e e5 56 f1 a5 05 4a 95 |=9%...j.>.V...J.|
+| 0e 56 49 f3 e4 0d 3f 05 |.VI...?. |
+hash out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+PRF out[16]:
+| fd 78 18 71 b0 eb fe a5 c0 3c 36 49 53 84 f8 e2 |.x.q.....<6IS...|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 73 03 5d 6b 6d |s.]km |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+PRF out[32]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+| 7c 12 4c 4b 79 3b 80 12 02 e2 a5 c5 c0 fd 8c 46 ||.LKy;.........F|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 4d 3d 4f 82 10 |M=O.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 a9 15 55 43 63 f9 42 76 45 02 b6 d1 |R4. ..UCc.BvE...|
+| aa 46 fb 42 3e a2 31 f8 e1 0e aa 32 31 71 ad c4 |.F.B>.1....21q..|
+| 52 34 bf 20 ec c6 05 ca 3d 39 25 c8 c1 16 6a b2 |R4. ....=9%...j.|
+| 3e e5 56 f1 a5 05 4a 95 0e 56 49 f3 e4 0d 3f 05 |>.V...J..VI...?.|
+hash out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+PRF out[32]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+| 67 c2 33 9e 28 79 95 32 72 26 7e 67 fe ed 86 80 |g.3.(y.2r&~g....|
+Client MAC key[20]:
+| d8 9b 94 b5 cd 8d 34 81 7c d7 4e 05 34 26 f8 c6 |......4.|.N.4&..|
+| 9f d3 ea 26 |...& |
+Server MAC key[20]:
+| ff 51 b2 15 12 44 b2 ea 56 96 32 4f f4 1d 64 80 |.Q...D..V.2O..d.|
+| 18 30 43 d7 |.0C. |
+Client Write key[16]:
+| 35 7b ce 65 d6 9e 23 69 00 a4 8e cd 1f c2 cf 70 |5{.e..#i.......p|
+Server Write key[16]:
+| d0 ec 57 99 be bf 45 98 40 55 12 72 70 b9 9e b5 |..W...E.@U.rp...|
+Client Write IV[8]:
+| fd 78 18 71 b0 eb fe a5 |.x.q.... |
+Server Write IV[8]:
+| c0 3c 36 49 53 84 f8 e2 |.<6IS... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: RC2
+ssl_create_decoder can't find cipher RC2
+ssl_generate_keyring_material can't init client decoder
+dissect_ssl3_handshake can't generate keyring material
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 74 offset 86 length 10589566 bytes, remaining 134
+
+dissect_ssl enter frame #54 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 215 offset 186 length 3870598 bytes, remaining 234
+
+dissect_ssl enter frame #55 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 43026 found (nil)
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #56 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+association_find: TCP port 4437 found 0x2defbd0
+
+dissect_ssl enter frame #57 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #59 (first time)
+ conversation = 0x7facef996a78, ssl_session = 0x7facc3816d50
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x37
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+
+dissect_ssl enter frame #64 (first time)
+ssl_session_init: initializing ptr 0x7facc3818bb0 size 688
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53104 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4438
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #66 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0007 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| da 85 35 5e 4f 7b ab 4d 83 1d e9 25 f6 24 f5 9c |..5^O{.M...%.$..|
+| d9 2d f0 30 47 ed 06 0c c6 d9 18 ab 1d 43 9c 0e |.-.0G........C..|
+| b2 51 0b 20 26 44 f9 42 eb 25 a2 4f f5 49 70 9a |.Q. &D.B.%.O.Ip.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+PRF out[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+key expansion[88]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 c1 fd 09 90 43 b5 cc fc 7d e9 49 da |0/.I....C...}.I.|
+| 7c 52 cc 2c 1d 7a 08 be 1d 78 c1 3b d8 0b 4a da ||R.,.z...x.;..J.|
+| 1f 99 04 f8 bb f8 77 b9 e4 44 6c 9e fc 09 63 83 |......w..Dl...c.|
+| 54 c7 fa 1e 77 7a a1 3f 8b 79 54 db 51 41 6b 8e |T...wz.?.yT.QAk.|
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+Client MAC key[20]:
+| 86 ee a3 a5 35 87 c9 c5 30 73 07 c1 ad 39 62 7d |....5...0s...9b}|
+| 30 2f 04 49 |0/.I |
+Server MAC key[20]:
+| c1 fd 09 90 43 b5 cc fc 7d e9 49 da 7c 52 cc 2c |....C...}.I.|R.,|
+| 1d 7a 08 be |.z.. |
+Client Write key[16]:
+| 1d 78 c1 3b d8 0b 4a da 1f 99 04 f8 bb f8 77 b9 |.x.;..J.......w.|
+Server Write key[16]:
+| e4 44 6c 9e fc 09 63 83 54 c7 fa 1e 77 7a a1 3f |.Dl...c.T...wz.?|
+Client Write IV[8]:
+| 8b 79 54 db 51 41 6b 8e |.yT.QAk. |
+Server Write IV[8]:
+| 63 e8 4a 74 ae 33 e9 b4 |c.Jt.3.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #68 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc...
+looking for RSA pre-master1e816a2993b66faaadfc0adb44c121991b995cb2f6a087fd...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 4e 1c 59 33 ba 5a 5f a7 da 10 f3 59 03 c5 06 | N.Y3.Z_....Y...|
+| a1 8c 2d 47 61 34 80 6f 54 e8 00 c4 42 52 34 bf |..-Ga4.oT...BR4.|
+| 20 5e ad 31 4d 30 93 79 0a e2 ca 55 31 5b 5b de | ^.1M0.y...U1[[.|
+| ec 74 09 32 dc 2b 75 2f 76 f2 94 cc 73 |.t.2.+u/v...s |
+hash out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+PRF out[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+key expansion[88]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f |......:.....\U..|
+| e2 11 0c b2 0a cb 9f 18 0a cb 83 a3 c8 85 12 10 |................|
+| a9 bc 14 c6 87 7f a0 04 86 5f d1 b0 90 d2 4a a0 |........._....J.|
+| b3 4f 05 eb 82 60 7c cc 08 40 48 fb 65 45 97 d5 |.O...`|..@H.eE..|
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+Client MAC key[20]:
+| e0 7d 25 a1 e9 2d 06 43 3d d6 a2 d2 38 22 9d 58 |.}%..-.C=...8".X|
+| 81 e8 b0 a8 |.... |
+Server MAC key[20]:
+| a2 a3 3a 1d e8 c2 a8 cf 5c 55 9d 1f e2 11 0c b2 |..:.....\U......|
+| 0a cb 9f 18 |.... |
+Client Write key[16]:
+| 0a cb 83 a3 c8 85 12 10 a9 bc 14 c6 87 7f a0 04 |................|
+Server Write key[16]:
+| 86 5f d1 b0 90 d2 4a a0 b3 4f 05 eb 82 60 7c cc |._....J..O...`|.|
+Client Write IV[8]:
+| 08 40 48 fb 65 45 97 d5 |.@H.eE.. |
+Server Write IV[8]:
+| 04 b9 63 72 55 f8 82 11 |..crU... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: IDEA
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 67 7f e3 85 ed c9 ce b8 59 1d 0e dd 63 72 c7 |.g.......Y...cr.|
+| dc 2c 7f b3 12 f5 35 3f e1 6e c9 86 1f c5 f9 f3 |.,....5?.n......|
+| 6d dc 27 9a 09 0b 33 6b 1a 7c d4 c8 c9 20 fb e3 |m.'...3k.|... ..|
+Plaintext[48]:
+| 23 d6 42 31 8c 7b 61 dd 14 00 00 0c fb 18 0a bd |#.B1.{a.........|
+| 93 02 8d 0d 90 9f 15 3e af c7 ad a0 87 09 fd c5 |.......>........|
+| 06 14 d2 0f ef 6d 65 7f d9 95 cc 08 03 03 03 03 |.....me.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af c7 ad a0 87 09 fd c5 06 14 d2 0f ef 6d 65 7f |.............me.|
+| d9 95 cc 08 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #69 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d3 c0 58 c5 c6 54 86 69 26 a1 05 7b a0 51 56 27 |..X..T.i&..{.QV'|
+| 04 87 d5 d3 a1 aa 2a 0c b4 ff 67 18 5c d6 6c 7a |......*...g.\.lz|
+| 51 5e b2 ca 39 16 97 83 0f 7d 53 6b ce 1d f9 0c |Q^..9....}Sk....|
+Plaintext[48]:
+| 4c 1e 65 ed 4e 48 04 aa 14 00 00 0c 34 18 13 9c |L.e.NH......4...|
+| a0 66 7e c4 d8 16 e1 99 83 f4 97 23 d3 ab 38 ee |.f~........#..8.|
+| 48 cf 03 c3 fe 7a 83 45 fc 8e 76 93 03 03 03 03 |H....z.E..v.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 83 f4 97 23 d3 ab 38 ee 48 cf 03 c3 fe 7a 83 45 |...#..8.H....z.E|
+| fc 8e 76 93 |..v. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #70 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 35 ac 8b 9f 80 f7 30 f4 b4 b9 f5 76 f4 d9 1b 8c |5.....0....v....|
+| 0d e2 28 53 7d 25 da 5a 67 97 68 e2 25 fb d6 1c |..(S}%.Zg.h.%...|
+| a0 65 e1 8e 09 be af d4 83 56 7e 64 75 a6 01 95 |.e.......V~du...|
+| 77 aa a9 5b b3 5f 5b b4 fa 49 e8 75 17 db 93 24 |w..[._[..I.u...$|
+| ae 54 5f 7d bb ae 0a 71 ef 99 08 51 3f e8 7e b3 |.T_}...q...Q?.~.|
+| a7 4b 50 96 00 fe 30 ba a5 65 e9 c0 5c 73 30 5e |.KP...0..e..\s0^|
+Plaintext[96]:
+| 38 2c d3 47 db 0c 21 dc 47 45 54 20 2f 20 48 54 |8,.G..!.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 69 64 |TP/1.1..Host: id|
+| 65 61 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c |ea-cbc-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 33 38 0d 0a 0d 0a 37 97 29 df 25 2d |l:4438....7.).%-|
+| 1b 20 23 1a 1f 82 38 b3 60 3a fc 86 56 bf 01 01 |. #...8.`:..V...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 18 e2 ff 6a ca cb df 36 19 d5 8b 05 26 56 5e 1e |...j...6....&V^.|
+| fb 71 bc 39 |.q.9 |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53104 found (nil)
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #71 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| a1 45 b9 97 64 d0 47 d9 9b c3 1c 2f da 94 38 67 |.E..d.G..../..8g|
+| fc 9d cb 2a f7 37 7d ae ca f8 f6 d4 ca bd 8d fe |...*.7}.........|
+| 5a fb 12 e4 04 95 ec d7 43 85 d6 5f 2d bb 01 b4 |Z.......C.._-...|
+| 3a 37 de a1 11 d4 46 d6 3d 12 06 44 f6 c7 95 95 |:7....F.=..D....|
+| 18 52 45 0a d6 6f 64 a6 3b 99 92 14 01 7d 83 1d |.RE..od.;....}..|
+| 13 65 5b ce 97 68 00 33 fd b1 16 38 5f a0 41 d5 |.e[..h.3...8_.A.|
+| 4c 30 57 4f 42 94 13 5f ca c8 6b ba 2e f6 a8 16 |L0WOB.._..k.....|
+| c9 59 8b 83 cd ff 6e b2 6a d8 d3 84 98 c5 32 62 |.Y....n.j.....2b|
+| 6c 31 4f f3 b9 40 4f 89 89 36 45 76 8e 58 c4 ed |l1O..@O..6Ev.X..|
+| ec ea 15 0e 52 24 24 c2 2c 35 85 c2 31 2d f9 9e |....R$$.,5..1-..|
+| 91 08 19 3f 3c 5c 5b 78 b3 ec 6f 01 b4 28 b4 ee |...?<\[x..o..(..|
+| ff 07 e5 53 66 17 d9 69 74 fe f8 23 24 e6 8e 97 |...Sf..it..#$...|
+| b5 9d b5 d7 a2 ec 43 eb d9 2b 19 2f f5 45 a5 13 |......C..+./.E..|
+| 3d 53 86 c2 47 fd 02 ca c0 5c d2 84 fb 93 58 b4 |=S..G....\....X.|
+| 39 34 31 50 b6 47 1d 65 d0 4f b5 41 6a 31 c6 6a |941P.G.e.O.Aj1.j|
+| 01 87 e5 23 a1 fe 62 cf 90 60 bf 60 44 e7 b1 31 |...#..b..`.`D..1|
+| b8 07 00 c4 7f 0d 80 9f d2 70 f5 52 2f 8d ad 9e |.........p.R/...|
+| ab e6 dc 66 b9 97 92 f1 4d 0b bb ec 74 ad 11 a6 |...f....M...t...|
+| b4 15 af 2e 7d 81 22 e5 12 57 ec 5b 9b 39 0d 81 |....}."..W.[.9..|
+| 9c ff b1 81 9e fb 35 6a 7d 48 75 49 77 1a b9 b4 |......5j}HuIw...|
+| 2b 08 30 cb 8c 0b a7 95 53 52 4e c5 c3 b7 0d 91 |+.0.....SRN.....|
+| df 15 dd 5d 83 44 34 f4 81 6c fd 05 7a 9b 7c 98 |...].D4..l..z.|.|
+| c9 49 4f 03 73 58 5f 03 f2 a9 da 64 85 eb 9f 0a |.IO.sX_....d....|
+| c7 13 0a 93 c7 66 c7 f3 d6 0f a6 f4 3a 2d 74 08 |.....f......:-t.|
+Plaintext[384]:
+| ae 8e 99 76 d9 61 ff 9b 48 54 54 50 2f 31 2e 31 |...v.a..HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 37 |che....0x00,0x07|
+| 20 2d 20 49 44 45 41 2d 43 42 43 2d 53 48 41 20 | - IDEA-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 49 44 45 41 28 31 32 |RSA Enc=IDEA(12|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 84 cb 99 cb 63 c7 43 f1 9d 65 57 e6 |ipt>....c.C..eW.|
+| f9 d7 5b 9b a0 83 d5 c7 07 07 07 07 07 07 07 07 |..[.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 88 7d 45 11 65 2d 37 42 16 78 64 1b 34 d5 d5 9a |.}E.e-7B.xd.4...|
+| 35 e8 2f 09 |5./. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4438 found 0x3425920
+
+dissect_ssl enter frame #72 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d3 1b 64 b4 30 6e 52 69 a1 2c ab 4b e5 73 dc ab |..d.0nRi.,.K.s..|
+| a2 d6 68 81 e9 f3 43 e1 f9 d0 ef be 05 1c b7 2b |..h...C........+|
+Plaintext[32]:
+| 65 12 ec 15 a5 91 75 fd 01 00 49 03 75 0e 63 6c |e.....u...I.u.cl|
+| 16 e4 09 2a 3b 1c bb 02 58 20 7b 2a 6d 6f 01 01 |...*;...X {*mo..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 49 03 75 0e 63 6c 16 e4 09 2a 3b 1c bb 02 58 20 |I.u.cl...*;...X |
+| 7b 2a 6d 6f |{*mo |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #74 (first time)
+ conversation = 0x7facef996d20, ssl_session = 0x7facc3818bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 30 1a d1 69 69 23 95 42 88 f6 84 65 d7 7e cb da |0..ii#.B...e.~..|
+| 6e 01 48 45 9b d2 31 33 20 dd 4f e3 4e e8 87 35 |n.HE..13 .O.N..5|
+Plaintext[32]:
+| 72 1a 1f 8f 05 fb b5 47 01 00 e1 1f 21 eb 91 b4 |r......G....!...|
+| 62 ca b2 10 9b c5 0a 19 10 6b 61 9e c8 b3 01 01 |b........ka.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1f 21 eb 91 b4 62 ca b2 10 9b c5 0a 19 10 6b |..!...b........k|
+| 61 9e c8 b3 |a... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #79 (first time)
+ssl_session_init: initializing ptr 0x7facc381b170 size 688
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52165 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4439
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #81 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 1224
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0008 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| bb 38 ed 61 82 aa 21 db 07 d3 8c 72 31 91 f0 5e |.8.a..!....r1..^|
+| 7e 79 af e4 52 3d a1 c5 97 e3 8b d2 f7 fb 66 16 |~y..R=........f.|
+| 78 d4 2b d7 a9 d9 29 7c 2f b1 6b bf 95 be f4 be |x.+...)|/.k.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+PRF out[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+key expansion[72]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 |..Z..../......k.|
+| 42 d6 9d 5a 3e 5e e2 02 2d 43 ce 68 92 b9 13 35 |B..Z>^..-C.h...5|
+| a1 ad 86 fc 66 59 3f 22 6c b6 11 60 fa 3c 57 7b |....fY?"l..`.<W{|
+| d3 26 8f 48 cc 63 0d 8d |.&.H.c.. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| 2d 43 ce 68 92 |-C.h. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+PRF out[32]:
+| 2f e0 62 90 e6 dc 26 9e 4b 61 89 1c de 01 76 a9 |/.b...&.Ka....v.|
+| aa e9 84 36 76 08 3e 8f 46 ac 61 28 61 a2 80 c0 |...6v.>.F.a(a...|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| b9 13 35 a1 ad |..5.. |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+PRF out[32]:
+| 1d f8 a0 57 33 05 9d 5a 72 62 8c 88 9f 5a bb e6 |...W3..Zrb...Z..|
+| 70 eb 98 da c8 bd a3 f5 c5 11 b9 c8 32 36 1a 65 |p...........26.e|
+Client MAC key[20]:
+| 60 0e 82 4a b3 76 1c 48 49 65 e6 f4 7e 22 e9 29 |`..J.v.HIe..~".)|
+| ab f6 5a dc |..Z. |
+Server MAC key[20]:
+| bd bc bd 2f a0 ac 1e 8b 91 d2 6b 93 42 d6 9d 5a |.../......k.B..Z|
+| 3e 5e e2 02 |>^.. |
+Client Write key[8]:
+| 2f e0 62 90 e6 dc 26 9e |/.b...&. |
+Server Write key[8]:
+| 1d f8 a0 57 33 05 9d 5a |...W3..Z |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1161
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 349
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 335, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 331 bytes, remaining 1215
+ record: offset = 1215, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1220 length 0 bytes, remaining 1224
+
+dissect_ssl enter frame #83 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 134
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 70, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 66 bytes, remaining 75
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309f...
+looking for RSA pre-mastera62989ead4a8a5e58bf2f6a2f811703a3d65165916bb8dda...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea 92 90 d8 | r.-...+.6F.....|
+| 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 52 34 bf |8:.H..5..e...R4.|
+| 20 67 b7 88 04 84 02 72 40 18 18 2e ed 93 35 10 | g.....r@.....5.|
+| 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |..%0..N..r... |
+hash out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+PRF out[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+key expansion[72]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 fb 2f c2 20 9b 0b ed bd 10 38 6e eb |.%|../. .....8n.|
+| 49 5b 72 32 ce 63 7c 2f a1 de 58 84 98 f9 5d b0 |I[r2.c|/..X...].|
+| 8c 6f 6a fe 78 b6 73 34 8d 6b 3d d8 9c ab a8 d7 |.oj.x.s4.k=.....|
+| 68 80 55 5d 85 34 6c c4 |h.U].4l. |
+ssl_generate_keyring_material prf(iv_block)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 0 seed_len 72 )
+tls_hash: hash secret[0]:
+tls_hash: hash seed[72]:
+| 49 56 20 62 6c 6f 63 6b 52 34 bf 20 67 b7 88 04 |IV blockR4. g...|
+| 84 02 72 40 18 18 2e ed 93 35 10 1f 87 25 30 9f |..r@.....5...%0.|
+| df 4e 9d 8e 72 d5 0b bf 52 34 bf 20 72 01 2d fe |.N..r...R4. r.-.|
+| 9c f1 2b b9 36 46 d4 ea 92 90 d8 38 3a 19 48 f0 |..+.6F.....8:.H.|
+| 0e 35 d8 dc 65 e4 c0 07 |.5..e... |
+hash out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+PRF out[16]:
+| 1a 56 15 98 62 8c 1a c5 f6 02 d4 da b4 c4 b5 bb |.V..b...........|
+ssl_generate_keyring_material PRF(key_c)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| a1 de 58 84 98 |..X.. |
+tls_hash: hash seed[80]:
+| 63 6c 69 65 6e 74 20 77 72 69 74 65 20 6b 65 79 |client write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+PRF out[32]:
+| ef 0d 2b 13 ce 78 93 43 23 8d a0 88 0a d5 9b b3 |..+..x.C#.......|
+| 63 08 f6 d9 1c fa c4 ca e2 81 05 c6 cb 45 c3 95 |c............E..|
+ssl_generate_keyring_material PRF(key_s)
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 5 seed_len 80 )
+tls_hash: hash secret[5]:
+| f9 5d b0 8c 6f |.]..o |
+tls_hash: hash seed[80]:
+| 73 65 72 76 65 72 20 77 72 69 74 65 20 6b 65 79 |server write key|
+| 52 34 bf 20 67 b7 88 04 84 02 72 40 18 18 2e ed |R4. g.....r@....|
+| 93 35 10 1f 87 25 30 9f df 4e 9d 8e 72 d5 0b bf |.5...%0..N..r...|
+| 52 34 bf 20 72 01 2d fe 9c f1 2b b9 36 46 d4 ea |R4. r.-...+.6F..|
+| 92 90 d8 38 3a 19 48 f0 0e 35 d8 dc 65 e4 c0 07 |...8:.H..5..e...|
+hash out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+PRF out[32]:
+| 99 f4 36 14 b1 15 c3 94 e6 eb 1d f4 4f 21 78 8a |..6.........O!x.|
+| 3e aa 20 99 ca 2b 4d bc bc e8 ca 51 12 4e 94 c8 |>. ..+M....Q.N..|
+Client MAC key[20]:
+| da bc 7a 95 4f fa e7 d6 24 12 d6 11 eb 59 74 4e |..z.O...$....YtN|
+| ce 25 7c b6 |.%|. |
+Server MAC key[20]:
+| fb 2f c2 20 9b 0b ed bd 10 38 6e eb 49 5b 72 32 |./. .....8n.I[r2|
+| ce 63 7c 2f |.c|/ |
+Client Write key[8]:
+| ef 0d 2b 13 ce 78 93 43 |..+..x.C |
+Server Write key[8]:
+| 99 f4 36 14 b1 15 c3 94 |..6..... |
+Client Write IV[8]:
+| 1a 56 15 98 62 8c 1a c5 |.V..b... |
+Server Write IV[8]:
+| f6 02 d4 da b4 c4 b5 bb |........ |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 75, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 81, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9e 2f 76 d1 2f 2f b9 3b dd 2d bf c9 71 ea 86 29 |./v.//.;.-..q..)|
+| a4 2d 4c 2b 75 8c 0e 9e 10 49 1e bb 60 8c 2b 04 |.-L+u....I..`.+.|
+| 1c 71 b9 ff 1f fe 98 86 ea 50 7f 05 8a 01 33 fb |.q.......P....3.|
+Plaintext[48]:
+| 24 51 a1 43 c0 ec a3 1a 14 00 00 0c aa 2a 3d 27 |$Q.C.........*='|
+| 66 61 97 a7 58 37 13 b6 36 ab dc c7 72 bd a3 8a |fa..X7..6...r...|
+| cf fc 79 75 9d 69 52 63 ac 99 01 91 03 03 03 03 |..yu.iRc........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 36 ab dc c7 72 bd a3 8a cf fc 79 75 9d 69 52 63 |6...r.....yu.iRc|
+| ac 99 01 91 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #84 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 02 97 a5 f6 a9 60 b1 e6 25 f6 af 28 a0 00 5e 4e |.....`..%..(..^N|
+| d8 e1 3e 4b 6e bd 2b f4 88 6e 71 34 a9 38 16 b2 |..>Kn.+..nq4.8..|
+| 12 a4 a0 1e 74 46 5c 28 fc 04 9a 2f 88 82 ae 01 |....tF\(.../....|
+Plaintext[48]:
+| f2 99 b1 0e ac c0 45 f1 14 00 00 0c 03 4e 36 17 |......E......N6.|
+| 0b 12 6b f2 c1 ab 9c 9e 4f 12 5a a2 8c a1 e5 c5 |..k.....O.Z.....|
+| ed f5 77 d2 51 0d 10 e1 6f cc dd 29 03 03 03 03 |..w.Q...o..)....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4f 12 5a a2 8c a1 e5 c5 ed f5 77 d2 51 0d 10 e1 |O.Z.......w.Q...|
+| 6f cc dd 29 |o..) |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #85 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| d5 df 46 7f 5e 0e ee 94 fe d8 89 05 b4 fd cd c3 |..F.^...........|
+| c6 b3 a6 60 51 ce c2 42 9f 26 23 d6 c9 6d 9e d2 |...`Q..B.&#..m..|
+| 96 c2 3a 5d f9 68 a4 64 1d 94 cc 0a 9f c7 43 f6 |..:].h.d......C.|
+| b8 e5 f1 cf 3d 14 22 b6 c9 5d 26 02 32 4a 6a 29 |....=."..]&.2Jj)|
+| f4 66 ca 68 35 19 7a 67 fb 94 70 d9 9b 58 67 6c |.f.h5.zg..p..Xgl|
+| 41 dd 04 e0 2d 7f 99 e9 29 37 6f 0d 38 3e b7 83 |A...-...)7o.8>..|
+| 54 eb e9 6e 3a ed 43 25 |T..n:.C% |
+Plaintext[104]:
+| a4 89 ea 43 1b eb ed 86 47 45 54 20 2f 20 48 54 |...C....GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 78 |TP/1.1..Host: ex|
+| 70 2d 64 65 73 2d 63 62 63 2d 73 68 61 2e 6c 6f |p-des-cbc-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 33 39 0d 0a 0d 0a 93 00 b8 |n.nl:4439.......|
+| 41 d0 ae 0c 83 0a a8 b2 d8 14 3f ac b9 00 71 a9 |A.........?...q.|
+| 11 06 06 06 06 06 06 06 |........ |
+ssl_decrypt_record found padding 6 final len 97
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 93 df f4 91 22 37 94 81 50 48 8a d4 88 08 65 e5 |...."7..PH....e.|
+| ef 4b 2a e1 |.K*. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52165 found (nil)
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #86 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| d0 c7 ac f3 05 4f c3 4e ac 40 c5 57 06 0b 60 bf |.....O.N.@.W..`.|
+| 4c c7 82 3e 85 78 50 02 81 e9 18 cb 92 dd 4e 46 |L..>.xP.......NF|
+| 51 5c a7 59 53 94 59 cd a9 d8 90 fe 3f 7f 0d 7a |Q\.YS.Y.....?..z|
+| ab bf ec a3 e3 20 f7 85 35 04 60 7f 52 42 0d 4a |..... ..5.`.RB.J|
+| 63 51 d2 8d 15 b2 88 8a 9b 7d d7 3d 6d 56 6c 9c |cQ.......}.=mVl.|
+| 75 6b 85 12 61 fc 39 a7 29 d8 fd 77 aa ee e3 4e |uk..a.9.)..w...N|
+| ee a2 1c 19 35 9f 80 c6 a6 fe 08 93 ed ff 89 71 |....5..........q|
+| 13 3c 70 84 5b 44 2c d0 64 a1 26 77 fa 97 0f 49 |.<p.[D,.d.&w...I|
+| 2b 23 c1 f9 21 2f 93 58 23 18 78 1d aa ea b5 ee |+#..!/.X#.x.....|
+| 7e 47 e0 dd b5 85 fe b8 b4 6b 5f 29 9b 32 85 d7 |~G.......k_).2..|
+| da 74 da ff ad 66 20 02 bd 6e a1 11 d1 41 43 35 |.t...f ..n...AC5|
+| 4f 8b 13 65 93 d2 a8 a1 93 1b d2 ed 73 d2 55 13 |O..e........s.U.|
+| e0 52 7d 0b 3b ef e0 0f 52 28 8f a6 23 d5 a3 6d |.R}.;...R(..#..m|
+| e0 30 b4 6e 68 7e 59 02 df 23 b7 69 51 52 66 7e |.0.nh~Y..#.iQRf~|
+| f3 79 d0 98 ab 2d ec 95 3c 20 16 59 51 bb 6b 59 |.y...-..< .YQ.kY|
+| c3 1f e2 a8 ca b6 f3 69 33 48 5e 2b 17 f9 7f e4 |.......i3H^+....|
+| 2b cb 3c 99 25 5c 10 10 44 93 50 e0 4a a4 3b 25 |+.<.%\..D.P.J.;%|
+| 51 ba 88 08 f8 de 64 e4 62 7f 53 e2 b6 5b 30 fc |Q.....d.b.S..[0.|
+| 38 1b 39 f1 2b 48 a7 b2 c1 37 42 f9 1b b2 24 63 |8.9.+H...7B...$c|
+| 60 6c 3c 42 6d 40 c0 30 75 ec 0f 48 c1 bf 0b 76 |`l<Bm@.0u..H...v|
+| c1 41 c2 7a 8b 06 6d 7b 83 a8 dc 8d f0 43 45 40 |.A.z..m{.....CE@|
+| 00 44 e4 74 05 ed c5 96 38 e1 a6 b9 58 04 d4 dd |.D.t....8...X...|
+| da 79 1b 38 70 c7 d3 da 90 ea 19 da 3a c4 78 ee |.y.8p.......:.x.|
+| aa dd 52 5b ce 98 a8 a6 4c bc f8 83 78 57 f5 c1 |..R[....L...xW..|
+Plaintext[384]:
+| fd 3e c1 46 cb 01 dd bd 48 54 54 50 2f 31 2e 31 |.>.F....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 38 0d |ent-Length: 148.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 38 |che....0x00,0x08|
+| 20 2d 20 45 58 50 2d 44 45 53 2d 43 42 43 2d 53 | - EXP-DES-CBC-S|
+| 48 41 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 |HA SSLv3|
+| 20 4b 78 3d 52 53 41 28 35 31 32 29 20 41 75 3d | Kx=RSA(512) Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 34 30 29 |RSA Enc=DES(40)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 20 65 78 70 6f | Mac=SHA1 expo|
+| 72 74 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 |rt<script>docume|
+| 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 6c |nt.domain='local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 27 3c 2f 73 63 72 69 70 74 3e 02 d9 be 01 69 |l'</script>....i|
+| 26 10 0f 06 e2 8f e2 b9 d9 f0 34 de 06 15 c2 00 |&.........4.....|
+ssl_decrypt_record found padding 0 final len 383
+checking mac (len 355, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b3 bc 22 86 7e 5f f8 3a 84 6a 1b 8b b5 0d 62 c0 |..".~_.:.j....b.|
+| ca c1 7f 40 |...@ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4439 found 0x342cfb0
+
+dissect_ssl enter frame #87 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 21 25 a2 6d 98 e3 24 3b 53 62 1c 7a d0 f7 6d f0 |!%.m..$;Sb.z..m.|
+| 73 1c d5 8c 19 1d 00 1c ef 69 90 e0 6d 24 8f a3 |s........i..m$..|
+Plaintext[32]:
+| 03 a5 dd be a0 be ef 4a 01 00 2a cf 2c 48 90 13 |.......J..*.,H..|
+| 7c ea cd 01 d7 6c dd 23 a8 a3 bd 4d 60 9c 01 01 ||....l.#...M`...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2a cf 2c 48 90 13 7c ea cd 01 d7 6c dd 23 a8 a3 |*.,H..|....l.#..|
+| bd 4d 60 9c |.M`. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #89 (first time)
+ conversation = 0x7facef996fc8, ssl_session = 0x7facc381b170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 37 7e 17 a7 c4 96 ff d7 75 c2 29 a6 97 50 2e 9c |7~......u.)..P..|
+| d4 40 b7 6b f2 14 9c 56 51 6e 3e b9 b3 c5 6f 89 |.@.k...VQn>...o.|
+Plaintext[32]:
+| 57 93 1e c1 ad a6 90 6b 01 00 51 df 8b 46 02 5c |W......k..Q..F.\|
+| f3 bd cd 30 44 eb d7 cb c5 ee 66 bb 74 d8 01 01 |...0D.....f.t...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 51 df 8b 46 02 5c f3 bd cd 30 44 eb d7 cb c5 ee |Q..F.\...0D.....|
+| 66 bb 74 d8 |f.t. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #94 (first time)
+ssl_session_init: initializing ptr 0x7facc381d630 size 688
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50147 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4440
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #96 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0009 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 8e 27 2f 89 e3 4d 48 21 c8 3a 6b 30 97 eb 80 00 |.'/..MH!.:k0....|
+| 4f 60 e2 ee fe b6 ea d0 38 e7 07 9d 35 a0 9f 92 |O`......8...5...|
+| e1 8b a9 91 31 87 14 7d 4b 72 62 9d de 00 d6 5f |....1..}Krb...._|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+PRF out[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+key expansion[72]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 |^C.o..p.._~9..%`|
+| f2 32 56 fb 9f a4 9a 8b 9f 58 38 0d 59 c0 86 12 |.2V......X8.Y...|
+| 0c 82 76 fe ec 53 37 c9 c6 61 03 48 fd 2a ce 40 |..v..S7..a.H.*.@|
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+Client MAC key[20]:
+| ed ee 6e f7 82 bd 80 29 0b 36 2e 22 4c 4f 65 fd |..n....).6."LOe.|
+| 5e 43 09 6f |^C.o |
+Server MAC key[20]:
+| bf 8f 70 81 97 5f 7e 39 f0 8e 25 60 f2 32 56 fb |..p.._~9..%`.2V.|
+| 9f a4 9a 8b |.... |
+Client Write key[8]:
+| 9f 58 38 0d 59 c0 86 12 |.X8.Y... |
+Server Write key[8]:
+| 0c 82 76 fe ec 53 37 c9 |..v..S7. |
+Client Write IV[8]:
+| c6 61 03 48 fd 2a ce 40 |.a.H.*.@ |
+Server Write IV[8]:
+| 8b a0 6d 38 34 8c 78 ce |..m84.x. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #98 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94...
+looking for RSA pre-master113e309073f08d54ca50f560cbcc67a69298e5c229d6ee4c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 c7 90 41 a1 7d 14 3c d6 35 74 00 b5 b7 cc af | ..A.}.<.5t.....|
+| 18 81 1d c7 ca 58 7e 80 31 5d fc a6 8a 52 34 bf |.....X~.1]...R4.|
+| 20 2e 5d 51 50 4a c7 92 3f 3a 67 a5 40 ea 38 66 | .]QPJ..?:g.@.8f|
+| f2 86 3c bb 94 d4 6a df f2 8a 7f a5 b8 |..<...j...... |
+hash out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+PRF out[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+key expansion[72]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 |.Y....nh.=~..,..|
+| 3d 0d 36 ac fe 16 83 d5 82 74 79 3f ec b5 47 7d |=.6......ty?..G}|
+| 67 8a 93 62 1b ca fd 45 8c 8a af b4 c2 61 12 81 |g..b...E.....a..|
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+Client MAC key[20]:
+| 50 5b 0c 9e af ad 01 9f 05 64 eb e3 75 62 63 98 |P[.......d..ubc.|
+| 9b 59 e5 f4 |.Y.. |
+Server MAC key[20]:
+| 85 db 6e 68 d4 3d 7e c4 17 2c 8b f8 3d 0d 36 ac |..nh.=~..,..=.6.|
+| fe 16 83 d5 |.... |
+Client Write key[8]:
+| 82 74 79 3f ec b5 47 7d |.ty?..G} |
+Server Write key[8]:
+| 67 8a 93 62 1b ca fd 45 |g..b...E |
+Client Write IV[8]:
+| 8c 8a af b4 c2 61 12 81 |.....a.. |
+Server Write IV[8]:
+| 0d 7f 38 ec b0 f5 3e 6b |..8...>k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4d 49 26 30 9f 76 b9 65 f2 de d9 fe b2 a4 a1 ec |MI&0.v.e........|
+| d4 ca 74 ce db 15 60 77 e5 c5 f8 2f 93 57 ae d4 |..t...`w.../.W..|
+| 12 d6 53 d0 40 e5 8f 5f 3b b0 2e 0c 57 b1 ef 17 |..S.@.._;...W...|
+Plaintext[48]:
+| b2 2d be 6a 6c 68 e3 67 14 00 00 0c 32 36 10 27 |.-.jlh.g....26.'|
+| 45 c2 35 2e e7 fd 99 ef e6 41 49 34 3a c8 68 cc |E.5......AI4:.h.|
+| 39 b6 bc be 20 25 c7 89 e5 7e 74 0a 03 03 03 03 |9... %...~t.....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e6 41 49 34 3a c8 68 cc 39 b6 bc be 20 25 c7 89 |.AI4:.h.9... %..|
+| e5 7e 74 0a |.~t. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #99 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 ea fd 82 d3 d6 6c e2 00 bb c3 84 1d 48 24 0a |......l......H$.|
+| 6f 2d 02 f4 77 5b 43 ac ab 04 7c 54 bd 2b 81 de |o-..w[C...|T.+..|
+| 76 7c c9 56 a0 35 d1 f6 ff ec ca 85 8c ea 1e e5 |v|.V.5..........|
+Plaintext[48]:
+| dd 05 d3 72 a2 14 09 14 14 00 00 0c ed 76 03 3a |...r.........v.:|
+| a3 69 18 52 fb dc 1b ef 0d 9c 8c bd 6b 84 4f 23 |.i.R........k.O#|
+| 8a c5 cd a6 59 9b 86 57 28 90 0b 02 03 03 03 03 |....Y..W(.......|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0d 9c 8c bd 6b 84 4f 23 8a c5 cd a6 59 9b 86 57 |....k.O#....Y..W|
+| 28 90 0b 02 |(... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #100 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 11 db b3 52 2e ad 38 13 bc 11 5d f4 29 5a 5c 06 |...R..8...].)Z\.|
+| a0 a9 08 da 2c 4f d2 19 77 1d 33 f4 75 2d 11 78 |....,O..w.3.u-.x|
+| e1 4f 11 0c a2 fc 38 1d 23 e1 9e af 16 21 37 58 |.O....8.#....!7X|
+| d5 90 60 4b 63 b0 1f 98 07 99 9f 00 29 5e 99 9e |..`Kc.......)^..|
+| b2 e0 1e 6c b5 e1 75 6d c1 0a ed 54 28 a4 c2 ef |...l..um...T(...|
+| 44 ea 12 60 ee 77 fc f8 11 81 07 33 68 6c bf 3b |D..`.w.....3hl.;|
+Plaintext[96]:
+| c5 34 71 10 4f 4f 9c 44 47 45 54 20 2f 20 48 54 |.4q.OO.DGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 2d 73 68 61 2e 6c 6f 63 61 6c 2e |s-cbc-sha.local.|
+| 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c |al.lekensteyn.nl|
+| 3a 34 34 34 30 0d 0a 0d 0a 6e 7d 5e 16 f6 79 c0 |:4440....n}^..y.|
+| ff 31 f9 b3 27 95 a0 f5 10 be bc fe 4b 02 02 02 |.1..'.......K...|
+ssl_decrypt_record found padding 2 final len 93
+checking mac (len 65, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7e 6f 9d 97 cf 0d 1d 4a d2 5e f0 23 ec 73 04 f5 |~o.....J.^.#.s..|
+| b8 a0 aa 89 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50147 found (nil)
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #101 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 20 7a e5 fb 30 5d bf 30 4b 54 b2 d8 7d db db 30 | z..0].0KT..}..0|
+| 49 22 22 28 c7 f5 8e a4 ad 6c b4 5d 0b 69 9f 7c |I""(.....l.].i.||
+| 5a 6a 56 1e 7e 3b 60 20 1c dd 27 e0 14 59 0c 5e |ZjV.~;` ..'..Y.^|
+| e5 c0 07 79 a6 4e a0 35 c1 a9 d5 d3 0c c8 f3 c1 |...y.N.5........|
+| ef 1c 07 f0 36 79 f3 0b 79 ff 7e d3 29 96 85 ac |....6y..y.~.)...|
+| a9 90 50 95 d4 9d 52 ab dc 9a bd c3 4b 7c 6b 55 |..P...R.....K|kU|
+| b2 44 00 91 0a d1 6c 69 d8 c8 1f 49 78 5a f8 b3 |.D....li...IxZ..|
+| 9e 9e 61 e4 86 b5 92 33 7f 14 83 95 41 93 d2 05 |..a....3....A...|
+| 4b a1 0a 05 35 38 5a 37 5d f4 c0 0e b0 1c d0 32 |K...58Z7]......2|
+| e2 9d 10 6d ff c3 8b af c5 18 3f d4 45 6a a8 84 |...m......?.Ej..|
+| 1e a9 ed c8 d1 1f 2b 56 a8 77 e7 75 62 9d 7f ee |......+V.w.ub...|
+| e7 cd 70 2e 92 15 f1 e2 87 b4 bc 13 df 81 fd 30 |..p............0|
+| 4c 02 41 6c 67 e8 be 2f 68 11 de e9 f1 3c 5e fb |L.Alg../h....<^.|
+| 3f ab 3a d0 87 1e b3 39 cb af 07 49 8a 9a 21 04 |?.:....9...I..!.|
+| 6c 23 45 94 a4 b9 ef 31 7b 4c c9 16 0c 6b 4d ad |l#E....1{L...kM.|
+| 3e 9a 08 cc 69 3f aa 05 35 d5 d0 d7 f7 6e 4a 60 |>...i?..5....nJ`|
+| f3 27 67 3d 96 3c 40 42 d1 94 38 00 09 75 47 73 |.'g=.<@B..8..uGs|
+| 14 74 3f 0f bb 60 3f e5 54 69 e9 2c 0d 27 12 fc |.t?..`?.Ti.,.'..|
+| 84 73 65 67 b9 c0 f3 72 d3 c8 70 db 14 8c 77 14 |.seg...r..p...w.|
+| b9 a4 62 9d 9a fb 3f 56 0e 96 6f ff 61 be ff 80 |..b...?V..o.a...|
+| 95 47 c5 a3 9c 5a 73 3c 27 c6 6f f7 15 bd 2f 12 |.G...Zs<'.o.../.|
+| 3d 26 23 42 b5 35 e5 1a 7e 85 21 ea b3 45 2f a6 |=&#B.5..~.!..E/.|
+| 73 06 d6 0d 28 33 82 13 de 53 f8 61 13 09 9f e0 |s...(3...S.a....|
+| 85 8f b7 73 56 e2 ba f4 97 31 45 d9 a2 b8 a6 0f |...sV....1E.....|
+Plaintext[384]:
+| 21 d5 ef cf b8 85 d2 01 48 54 54 50 2f 31 2e 31 |!.......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 39 |che....0x00,0x09|
+| 20 2d 20 44 45 53 2d 43 42 43 2d 53 48 41 20 20 | - DES-CBC-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 67 bb 26 a7 53 68 cb 4d d9 b0 61 14 |ipt>g.&.Sh.M..a.|
+| 08 13 d8 79 3a 36 a2 0a 07 07 07 07 07 07 07 07 |...y:6..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 fa 92 45 d4 13 d8 bb 5e 86 a6 3e 2b ab 10 05 |...E....^..>+...|
+| 66 af 62 d4 |f.b. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4440 found 0x342d040
+
+dissect_ssl enter frame #102 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| ca cd 98 23 77 ce f4 50 c2 57 19 9c 6a 94 96 83 |...#w..P.W..j...|
+| da e8 13 d1 6c be f0 4d e4 7e d9 86 d3 d0 00 5b |....l..M.~.....[|
+Plaintext[32]:
+| 6e ab 83 3a 0c 6a 54 72 01 00 7b 75 cf dc 51 f7 |n..:.jTr..{u..Q.|
+| 5f 4a de 1b 15 82 02 fd ce 0e e2 86 e7 eb 01 01 |_J..............|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7b 75 cf dc 51 f7 5f 4a de 1b 15 82 02 fd ce 0e |{u..Q._J........|
+| e2 86 e7 eb |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #104 (first time)
+ conversation = 0x7facef997270, ssl_session = 0x7facc381d630
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| d4 57 0a 93 7f ed 1e ca 54 06 8d 5c de 13 74 43 |.W......T..\..tC|
+| 6f 98 56 8f 55 8e 7c cb a0 80 21 38 ce ce f8 b9 |o.V.U.|...!8....|
+Plaintext[32]:
+| f2 89 20 50 3a 5d a2 8a 01 00 6c 47 5d 5a 84 c2 |.. P:]....lG]Z..|
+| 11 a8 4e 93 b7 2f 0e 46 2c 9d 58 91 e2 db 01 01 |..N../.F,.X.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 47 5d 5a 84 c2 11 a8 4e 93 b7 2f 0e 46 2c 9d |lG]Z....N../.F,.|
+| 58 91 e2 db |X... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #109 (first time)
+ssl_session_init: initializing ptr 0x7facc381fbf0 size 688
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 55756 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4441
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #111 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x000A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 6c 1f da 51 57 81 df 01 9e 94 ea f5 8e 72 48 dc |l..QW........rH.|
+| c2 2c 12 dc 04 5c 57 5a 37 ef 3a 71 39 2d 95 99 |.,...\WZ7.:q9-..|
+| a6 f6 17 bc c1 54 e7 3d 17 f1 f6 91 c3 ef 3d a7 |.....T.=......=.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+PRF out[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+key expansion[104]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be f5 77 31 d2 e3 59 16 50 ad 49 44 c2 |..3..w1..Y.P.ID.|
+| d7 ff bf 83 23 11 02 07 56 80 49 52 75 8a b0 66 |....#...V.IRu..f|
+| 66 5b d7 9e 3a 1a 20 6d 71 5b 66 e7 ed 85 85 05 |f[..:. mq[f.....|
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 8d 60 74 7d c3 94 cd 02 |q.r.N..3.`t}....|
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+Client MAC key[20]:
+| 0a de 8b dd 14 fe 08 16 79 a4 a0 a8 2f ae 21 a2 |........y.../.!.|
+| fa b9 33 be |..3. |
+Server MAC key[20]:
+| f5 77 31 d2 e3 59 16 50 ad 49 44 c2 d7 ff bf 83 |.w1..Y.P.ID.....|
+| 23 11 02 07 |#... |
+Client Write key[24]:
+| 56 80 49 52 75 8a b0 66 66 5b d7 9e 3a 1a 20 6d |V.IRu..ff[..:. m|
+| 71 5b 66 e7 ed 85 85 05 |q[f..... |
+Server Write key[24]:
+| 87 4a cf c1 f0 b4 99 3c f5 d0 b4 5c d4 65 57 ef |.J.....<...\.eW.|
+| 71 d1 72 d9 4e 7f 17 33 |q.r.N..3 |
+Client Write IV[8]:
+| 8d 60 74 7d c3 94 cd 02 |.`t}.... |
+Server Write IV[8]:
+| be ee 5c 28 3a a0 89 f8 |..\(:... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #113 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 326
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ec...
+looking for RSA pre-master002f09b09d0de0dba351fcefb17adf42995c476d0a2bd37f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 20 ec ae 5e 1e 08 83 3f 0f 67 6e cb 98 3f fc c8 | ..^...?.gn..?..|
+| c2 ed 34 c1 36 35 1a 6e 16 14 f3 bf 0c 52 34 bf |..4.65.n.....R4.|
+| 20 55 1b 2b 34 3b 58 88 41 66 88 fc 84 d8 de 28 | U.+4;X.Af.....(|
+| 44 e7 ce 19 ec c6 46 ca b8 31 dd f9 4b |D.....F..1..K |
+hash out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+PRF out[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+key expansion[104]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 |.....!........,.|
+| 98 44 b6 06 b2 54 66 cb 5f 49 2c 8d 04 b9 bf c1 |.D...Tf._I,.....|
+| 43 98 17 73 f1 65 a7 86 dc 5c ad 8d 68 6c a4 de |C..s.e...\..hl..|
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 1b d1 5a 49 1c 45 59 6b |.*...+. ..ZI.EYk|
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+Client MAC key[20]:
+| b3 c2 f0 17 24 e9 9f 3e 4a 35 ca da 43 03 f0 45 |....$..>J5..C..E|
+| bb c3 cf 9a |.... |
+Server MAC key[20]:
+| 7f 21 90 ac e3 02 ff cc 96 a7 2c 86 98 44 b6 06 |.!........,..D..|
+| b2 54 66 cb |.Tf. |
+Client Write key[24]:
+| 5f 49 2c 8d 04 b9 bf c1 43 98 17 73 f1 65 a7 86 |_I,.....C..s.e..|
+| dc 5c ad 8d 68 6c a4 de |.\..hl.. |
+Server Write key[24]:
+| 8a 73 e9 6a 67 c1 71 af 73 e7 fb ff 67 e6 93 a8 |.s.jg.q.s...g...|
+| 06 2a ad a5 bd 2b a6 20 |.*...+. |
+Client Write IV[8]:
+| 1b d1 5a 49 1c 45 59 6b |..ZI.EYk |
+Server Write IV[8]:
+| 85 05 60 cf 69 91 56 a7 |..`.i.V. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 64 d7 01 47 6d 68 ac be 80 ef 6a f6 0b 3e 38 2c |d..Gmh....j..>8,|
+| 2d 5c d7 1d f4 4d cc e3 09 c3 4c f6 5b fe d0 fd |-\...M....L.[...|
+| 9d e9 49 c3 a0 80 56 6c c4 b4 b8 a0 25 e3 00 e0 |..I...Vl....%...|
+Plaintext[48]:
+| 53 a9 17 8a a6 e5 f7 a2 14 00 00 0c 0b 5c 4f c2 |S............\O.|
+| 41 06 37 83 4a 3b 8e af cd 23 af 7a 24 a1 0e 71 |A.7.J;...#.z$..q|
+| 9b d0 6a 0f 9a 5e a3 5c 8c 27 ff 35 03 03 03 03 |..j..^.\.'.5....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 23 af 7a 24 a1 0e 71 9b d0 6a 0f 9a 5e a3 5c |.#.z$..q..j..^.\|
+| 8c 27 ff 35 |.'.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #114 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 47 5b eb de 90 8a 3d 10 98 da 79 32 f8 f7 fd 75 |G[....=...y2...u|
+| e9 03 0a 06 8d f6 f9 84 c8 ad b5 25 42 4f 10 42 |...........%BO.B|
+| 30 56 21 8e a6 18 bb c9 ef 7d 32 87 c6 e9 c4 b5 |0V!......}2.....|
+Plaintext[48]:
+| c0 f9 b0 90 c3 2d ad 4a 14 00 00 0c 97 aa 11 89 |.....-.J........|
+| 33 79 e3 13 5d 72 87 f0 76 41 81 af 18 ed 8d cd |3y..]r..vA......|
+| 09 9d ac dc 72 fa fc bb 47 13 bf 45 03 03 03 03 |....r...G..E....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 76 41 81 af 18 ed 8d cd 09 9d ac dc 72 fa fc bb |vA..........r...|
+| 47 13 bf 45 |G..E |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #115 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 101
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 96, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 96
+Ciphertext[96]:
+| 73 db bd d6 64 e3 d7 0a 0c 4a fb b6 24 c2 2a d4 |s...d....J..$.*.|
+| ca 9a ec 15 0b b0 47 20 2d 76 60 b1 dd 66 45 5c |......G -v`..fE\|
+| 58 f0 07 b7 47 3a 6f a2 45 90 4d fd 30 99 3f 32 |X...G:o.E.M.0.?2|
+| 43 84 88 47 59 57 2e af 6b c4 0f d9 52 18 5e e7 |C..GYW..k...R.^.|
+| ed 4b 97 52 f9 b4 51 4f 8f 3d 5a 68 9d 76 b1 76 |.K.R..QO.=Zh.v.v|
+| 66 16 b4 1e d1 a3 a9 c7 9f 14 33 4e 38 cd c8 6d |f.........3N8..m|
+Plaintext[96]:
+| fd 0c 83 39 38 9b 82 b9 47 45 54 20 2f 20 48 54 |...98...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 64 65 |TP/1.1..Host: de|
+| 73 2d 63 62 63 33 2d 73 68 61 2e 6c 6f 63 61 6c |s-cbc3-sha.local|
+| 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e |.al.lekensteyn.n|
+| 6c 3a 34 34 34 31 0d 0a 0d 0a 7d 31 90 11 1e d5 |l:4441....}1....|
+| a6 6e 98 a1 8d 51 2c 1f 9f 47 cd a1 6d d5 01 01 |.n...Q,..G..m...|
+ssl_decrypt_record found padding 1 final len 94
+checking mac (len 66, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| af 05 67 d6 7c 43 c7 1b 65 34 9d 67 d4 5e 20 eb |..g.|C..e4.g.^ .|
+| e7 e6 ac 49 |...I |
+ssl_decrypt_record: mac failed
+association_find: TCP port 55756 found (nil)
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #116 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 81 25 d4 59 0f 03 bc 3c ad 17 b0 01 a8 10 56 03 |.%.Y...<......V.|
+| 1e 2c 32 67 45 34 8b f8 66 8c 52 52 51 ed 13 b0 |.,2gE4..f.RRQ...|
+| 23 bc 36 78 3e e4 2d 0d a1 23 be 97 6b 19 6b 14 |#.6x>.-..#..k.k.|
+| 58 da d3 0f 12 17 aa 56 50 c8 aa 5b 7c 6f 2c 7f |X......VP..[|o,.|
+| cd 77 2a d5 a6 93 9e 1e 8f 1a cb 07 67 0d 8b 52 |.w*.........g..R|
+| 90 2a 52 c6 c2 d1 67 80 6a 1d 21 89 ec f1 3e ad |.*R...g.j.!...>.|
+| d8 33 fa 93 a2 b0 de b2 7d af 36 19 a3 6a 3b e5 |.3......}.6..j;.|
+| 51 d9 df 6c 7d 08 eb 92 a5 a9 ca ac 59 aa e4 59 |Q..l}.......Y..Y|
+| 15 63 e7 7f f4 79 b8 59 a5 e8 f6 3c cd c8 1c 60 |.c...y.Y...<...`|
+| 7d 0e ce b0 75 6b 5c cb d3 36 20 ea 0b 6c 6f 1c |}...uk\..6 ..lo.|
+| 63 21 7b 1c 2c 3c 21 c4 da 10 5b c5 eb 83 5f ae |c!{.,<!...[..._.|
+| 89 b7 42 89 0a 2e d5 4b 7b cf 76 af 25 0f c8 7e |..B....K{.v.%..~|
+| c6 ea cc 94 d2 ca d9 00 d4 69 95 f1 25 94 04 76 |.........i..%..v|
+| 05 cd a5 80 9e 59 4d ea 84 ed 1b 63 bc ec 9c e8 |.....YM....c....|
+| 36 30 ea f6 d9 83 8b 9d f2 48 f7 95 9c 2a 76 56 |60.......H...*vV|
+| 6f 7a 32 2e 9b 4f 0e 27 05 2e ad d9 74 d6 29 25 |oz2..O.'....t.)%|
+| 47 71 35 bb 85 eb 84 dc 66 6a c3 81 41 c6 1e 17 |Gq5.....fj..A...|
+| 68 0e 38 3e 39 d1 ea 8c aa 09 8b 09 c4 b8 49 cd |h.8>9.........I.|
+| 28 08 1f 96 61 38 05 e9 a1 06 9c 46 61 6b 08 00 |(...a8.....Fak..|
+| f1 e1 4d 50 e9 7f 9e 27 c4 46 06 3e 0c 7e ff 07 |..MP...'.F.>.~..|
+| 1f f7 c4 4c 24 5f 5f 94 0c 97 de 1a 66 f4 09 9f |...L$__.....f...|
+| 75 14 17 cb a4 3e 61 35 ec e7 8b 63 61 4e bc 96 |u....>a5...caN..|
+| 8e d3 d1 8f 8d 19 f8 f4 cf 7b ec 7a d6 f7 02 45 |.........{.z...E|
+| 1a bc 66 28 6e 45 5c 07 fe dd ee 3a d8 06 8a 0b |..f(nE\....:....|
+Plaintext[384]:
+| d7 87 da 2c b6 ac a8 e6 48 54 54 50 2f 31 2e 31 |...,....HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 32 20 47 4d |2013 19:55:12 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 30 41 |che....0x00,0x0A|
+| 20 2d 20 44 45 53 2d 43 42 43 33 2d 53 48 41 20 | - DES-CBC3-SHA |
+| 20 20 20 20 20 20 20 20 20 20 20 53 53 4c 76 33 | SSLv3|
+| 20 4b 78 3d 52 53 41 20 20 20 20 20 20 41 75 3d | Kx=RSA Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 1c 84 af 4f ea 91 26 ea 0b fb 4c c3 |ipt>...O..&...L.|
+| 9b c9 15 8e 1a 02 2b 6d 07 07 07 07 07 07 07 07 |......+m........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a3 5d 7a ca 0d 41 2c 16 d2 05 1c 14 d2 fe b5 ff |.]z..A,.........|
+| c9 df da 04 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4441 found 0x342d0d0
+
+dissect_ssl enter frame #117 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 2b 1b f6 bf 99 db 13 91 ea a9 e6 70 92 3e 80 d2 |+..........p.>..|
+| 29 be 4e 47 2f 5c bd 57 73 50 c5 af 0c 6d 97 0e |).NG/\.WsP...m..|
+Plaintext[32]:
+| 0e a7 12 62 90 a2 6a c8 01 00 ee 80 00 9b 9c 51 |...b..j........Q|
+| ed a5 c3 5b 34 71 45 b2 b1 9e a2 cf d8 91 01 01 |...[4qE.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 80 00 9b 9c 51 ed a5 c3 5b 34 71 45 b2 b1 9e |.....Q...[4qE...|
+| a2 cf d8 91 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #119 (first time)
+ conversation = 0x7facef997518, ssl_session = 0x7facc381fbf0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 58 4f 72 ed 2c 1f 62 60 69 57 1c ad b9 72 0b 3c |XOr.,.b`iW...r.<|
+| 6e 15 79 a3 b9 85 e2 0e 0d 6c 8a a3 aa e7 07 3c |n.y......l.....<|
+Plaintext[32]:
+| e1 ef 85 ff bb 67 17 3e 01 00 74 b7 63 97 30 e2 |.....g.>..t.c.0.|
+| 31 6a e0 09 a2 b4 95 b8 d0 e5 aa 60 ef 72 01 01 |1j.........`.r..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 74 b7 63 97 30 e2 31 6a e0 09 a2 b4 95 b8 d0 e5 |t.c.0.1j........|
+| aa 60 ef 72 |.`.r |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #124 (first time)
+ssl_session_init: initializing ptr 0x7facc3822170 size 688
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47475 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4443
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #126 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0012 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| d0 17 98 30 78 3d 4c df f6 19 67 c0 a2 58 33 2d |...0x=L...g..X3-|
+| b6 8e 2f bd c1 2f ef c3 09 3b 0e a2 3d d3 98 47 |../../...;..=..G|
+| a9 40 b4 58 43 b7 e5 08 93 e6 e7 89 2a 2a c6 b7 |.@.XC.......**..|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+PRF out[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+key expansion[72]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d 3a 09 14 d8 cc 41 5b 87 84 18 51 0d |/.Dm:....A[...Q.|
+| fa 6b 1a c1 d2 dd ee 99 ae 7e 55 f1 46 cc 7f 2f |.k.......~U.F../|
+| a6 48 c3 fe e6 7c 70 ed 2e 80 8f 37 fc 81 8c 65 |.H...|p....7...e|
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+Client MAC key[20]:
+| 39 3b d5 67 7b 2a 68 fa 95 6c ee 99 17 62 56 38 |9;.g{*h..l...bV8|
+| 2f ca 44 6d |/.Dm |
+Server MAC key[20]:
+| 3a 09 14 d8 cc 41 5b 87 84 18 51 0d fa 6b 1a c1 |:....A[...Q..k..|
+| d2 dd ee 99 |.... |
+Client Write key[8]:
+| ae 7e 55 f1 46 cc 7f 2f |.~U.F../ |
+Server Write key[8]:
+| a6 48 c3 fe e6 7c 70 ed |.H...|p. |
+Client Write IV[8]:
+| 2e 80 8f 37 fc 81 8c 65 |...7...e |
+Server Write IV[8]:
+| aa 79 50 4b fd 88 01 28 |.yPK...( |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #128 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea04096...
+looking for RSA pre-master0080b8603544edfde42c437eb40569d8924b670069534998...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 e2 e9 62 ea 05 3b 39 5a 34 50 b6 73 74 c6 8b |!..b..;9Z4P.st..|
+| 10 d9 74 c3 ea f2 38 d4 75 26 d3 a1 22 52 34 bf |..t...8.u&.."R4.|
+| 21 f0 ba 1b d8 02 1a 6d a9 e7 c7 57 7f a3 00 a2 |!......m...W....|
+| 41 ae a0 40 96 0f fe 8a da 41 d1 19 24 |A..@.....A..$ |
+hash out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+PRF out[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+key expansion[72]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 a9 07 e8 e8 db d7 87 10 a5 c3 72 08 |D.............r.|
+| 28 4d b0 4c 65 40 0d a2 c0 9e 03 fc 60 02 8f 26 |(M.Le@......`..&|
+| 3c 51 cd a9 2f 0d 6f 76 1d bb e0 92 17 48 aa 0e |<Q../.ov.....H..|
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+Client MAC key[20]:
+| b7 d8 7c b4 88 f8 58 ac 73 d4 d0 25 99 03 69 55 |..|...X.s..%..iU|
+| 44 8a 03 a7 |D... |
+Server MAC key[20]:
+| a9 07 e8 e8 db d7 87 10 a5 c3 72 08 28 4d b0 4c |..........r.(M.L|
+| 65 40 0d a2 |e@.. |
+Client Write key[8]:
+| c0 9e 03 fc 60 02 8f 26 |....`..& |
+Server Write key[8]:
+| 3c 51 cd a9 2f 0d 6f 76 |<Q../.ov |
+Client Write IV[8]:
+| 1d bb e0 92 17 48 aa 0e |.....H.. |
+Server Write IV[8]:
+| 1c 16 94 25 c6 08 e8 1a |...%.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e7 7a 13 54 dd f2 f6 fa 66 95 fa 78 b6 35 fb 7b |.z.T....f..x.5.{|
+| c8 0b 02 69 09 55 e2 de d9 dc 78 3b b1 d4 73 fd |...i.U....x;..s.|
+| 1b 39 10 ec 70 c0 07 7d fa 65 64 f7 cd e3 32 1b |.9..p..}.ed...2.|
+Plaintext[48]:
+| f8 ba 66 a0 c5 f2 aa 27 14 00 00 0c a1 94 7b 7c |..f....'......{||
+| 50 b6 db d7 23 b3 d5 e6 5d 50 13 15 c2 c6 a0 13 |P...#...]P......|
+| 1f f1 ad 62 02 63 1c 4d 62 69 01 48 03 03 03 03 |...b.c.Mbi.H....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 50 13 15 c2 c6 a0 13 1f f1 ad 62 02 63 1c 4d |]P.........b.c.M|
+| 62 69 01 48 |bi.H |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #129 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d5 f9 70 e3 57 3f 97 6a c0 84 4c 1d 32 e1 71 47 |..p.W?.j..L.2.qG|
+| 38 1d 6e 43 a1 89 0f 85 51 f6 62 d1 55 ed a8 0e |8.nC....Q.b.U...|
+| a4 6d d0 50 54 d0 05 86 5e e2 a8 78 61 33 50 99 |.m.PT...^..xa3P.|
+Plaintext[48]:
+| 29 0f c6 15 ba 5a a0 aa 14 00 00 0c 6a 86 2b bf |)....Z......j.+.|
+| a5 7a f7 b5 15 a8 22 95 cd c2 cb fd 3b 7d 57 ff |.z....".....;}W.|
+| 45 f0 43 46 5c 0a 12 32 a9 05 a7 b6 03 03 03 03 |E.CF\..2........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd c2 cb fd 3b 7d 57 ff 45 f0 43 46 5c 0a 12 32 |....;}W.E.CF\..2|
+| a9 05 a7 b6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #130 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 95 c6 8f 5c cb a6 bb c8 e4 9a a7 a1 be a7 99 46 |...\...........F|
+| de 1c 4c e0 39 cf 77 4d e7 ed ed 6f 3c a1 48 b7 |..L.9.wM...o<.H.|
+| bd d8 50 3c 3e 5d a0 b0 26 04 e2 da c4 d5 50 95 |..P<>]..&.....P.|
+| 83 f2 ba 23 37 68 7d 72 7f 7e d0 48 a8 3f 6b 0e |...#7h}r.~.H.?k.|
+| 12 f9 57 e4 ad 57 0f 59 02 a9 d5 a2 99 f5 c8 1c |..W..W.Y........|
+| 90 84 2c ff 97 be 29 57 1d 16 ee 21 e2 f3 1f ae |..,...)W...!....|
+| f5 25 0f 1a df 9b 85 ca |.%...... |
+Plaintext[104]:
+| 0f b6 f3 e9 59 cb de b5 47 45 54 20 2f 20 48 54 |....Y...GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 2d 73 68 |h-dss-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 33 0d 0a 0d |steyn.nl:4443...|
+| 0a 30 b3 29 3d e2 4e 08 46 ce e8 51 6a 61 77 c2 |.0.)=.N.F..Qjaw.|
+| bc 6a b4 9b 16 02 02 02 |.j...... |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 38 8e cb 90 10 df af 98 1b 8d 0c 1c 56 f1 5a f0 |8...........V.Z.|
+| 04 a4 50 46 |..PF |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47475 found (nil)
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #131 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 33 5f 3a 79 09 d7 bd 7b 84 37 ea 25 af ee e3 ad |3_:y...{.7.%....|
+| ad bf 90 af 9c 41 19 76 ba 56 71 12 3d 40 01 8f |.....A.v.Vq.=@..|
+| 79 b0 66 a4 21 6e 40 d1 d9 22 12 61 72 43 66 f2 |y.f.!n@..".arCf.|
+| c1 d2 40 ba 47 ce bb 41 bc cb 61 d5 fc ed a9 81 |..@.G..A..a.....|
+| 8c 02 fb e2 1a 21 8a 04 25 31 d4 d8 b4 38 8c ae |.....!..%1...8..|
+| 28 47 dd 21 9b a6 02 ed 43 9a 3e 47 a4 31 34 2d |(G.!....C.>G.14-|
+| be 83 2b 8e f5 86 f8 fb d6 30 0e 17 31 c2 83 a4 |..+......0..1...|
+| 44 92 8b 7b d6 0a bf 07 bc 64 70 1b 51 0b 7f fa |D..{.....dp.Q...|
+| 5d 9a da 3a 90 54 87 e8 d2 7d 4f 03 5b 1b d3 01 |]..:.T...}O.[...|
+| fe e9 ea 78 37 39 c0 3a 97 a8 c3 78 75 46 66 a1 |...x79.:...xuFf.|
+| eb b9 b7 52 9d 51 b3 b0 5d 1c 9b 10 45 41 c3 33 |...R.Q..]...EA.3|
+| 64 2e 0b 3a 80 f1 ca db be eb 96 e2 b7 d2 d2 52 |d..:...........R|
+| 52 ba bb df 71 54 b7 22 af ba 05 6f b5 76 5d dc |R...qT."...o.v].|
+| c5 f6 73 fc ea cf 02 c6 7a 7d c1 4e 3f 50 72 83 |..s.....z}.N?Pr.|
+| c4 ca 31 87 50 ae d7 ac c5 9f 28 9a 5d f8 76 a4 |..1.P.....(.].v.|
+| c6 b2 f4 75 a2 a9 d1 f0 7f 6c fe 88 90 0a 90 61 |...u.....l.....a|
+| 7e 44 96 df bd de 2d 12 cd 35 b1 90 b6 20 c3 69 |~D....-..5... .i|
+| f8 81 19 80 7b 95 4b f7 a0 a1 f6 bd 45 23 ef 34 |....{.K.....E#.4|
+| d8 ed 6f 7e 1c 3d b4 22 98 37 d1 0a 53 e2 e5 22 |..o~.=.".7..S.."|
+| 9e 15 02 ad a0 80 dd 75 6a aa 0a ff 45 fd f0 e4 |.......uj...E...|
+| 43 7c b8 21 5f a1 90 25 d3 d5 9e 94 07 e4 fe 59 |C|.!_..%.......Y|
+| fd 2d b7 48 42 8e 69 cb 94 f7 28 fc 19 51 ff 68 |.-.HB.i...(..Q.h|
+| b8 8d 3f ab b7 1f 8c 56 d5 ee ed 51 e6 9c 88 b9 |..?....V...Q....|
+| 85 62 9f 03 f5 7c 4b 96 97 33 03 e6 16 3c e7 1e |.b...|K..3...<..|
+Plaintext[384]:
+| b8 c5 19 0e 41 d7 91 e7 48 54 54 50 2f 31 2e 31 |....A...HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 32 |che....0x00,0x12|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |DSS Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 20 9f 38 33 9a a2 e3 42 08 af 1a 6f |ipt> .83...B...o|
+| cb ac 11 16 62 65 d9 77 07 07 07 07 07 07 07 07 |....be.w........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 58 1b 47 bf a2 88 97 eb 49 d3 35 9c fc a1 4d 5c |X.G.....I.5...M\|
+| 87 07 38 48 |..8H |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4443 found 0x342da70
+
+dissect_ssl enter frame #132 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 6c 54 ca a5 84 57 b5 d7 ea 2e 7a 6e 19 22 f0 6a |lT...W....zn.".j|
+| 3c 55 3f 0a 23 81 3b 04 3e ef cc b8 8f 3f b9 71 |<U?.#.;.>....?.q|
+Plaintext[32]:
+| 7c cf ac eb eb 9f a8 1c 01 00 a8 98 04 64 39 d7 ||............d9.|
+| 7a e9 a5 36 a7 56 6a 02 01 53 eb 29 76 e9 01 01 |z..6.Vj..S.)v...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a8 98 04 64 39 d7 7a e9 a5 36 a7 56 6a 02 01 53 |...d9.z..6.Vj..S|
+| eb 29 76 e9 |.)v. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #134 (first time)
+ conversation = 0x7facef9977c0, ssl_session = 0x7facc3822170
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 61 19 65 f7 6a d4 16 67 e4 22 76 29 6d 87 2b 0a |a.e.j..g."v)m.+.|
+| d3 55 54 ad c6 3f 72 9d 94 79 af 92 66 42 d5 75 |.UT..?r..y..fB.u|
+Plaintext[32]:
+| d8 42 0a 0d 6e b2 ea ce 01 00 e1 70 ad 00 81 93 |.B..n......p....|
+| 0c ce bb b9 3e ad 2c f7 25 4f 35 d4 84 a4 01 01 |....>.,.%O5.....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 70 ad 00 81 93 0c ce bb b9 3e ad 2c f7 25 4f |.p........>.,.%O|
+| 35 d4 84 a4 |5... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #139 (first time)
+ssl_session_init: initializing ptr 0x7facc3824670 size 688
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60402 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4444
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #141 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0013 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9e 19 2b 69 f9 61 2e 65 7b d0 c5 4b 0a ba 9c d8 |..+i.a.e{..K....|
+| df dc f7 84 88 1c 06 b5 16 44 0c 12 c6 bd 4b 45 |.........D....KE|
+| 18 b6 eb a8 da 1d 61 1b a5 bd 1a c4 81 c7 e2 39 |......a........9|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+PRF out[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+key expansion[104]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c 37 db 48 db cb d1 5f 66 89 d3 97 bc |.\.l7.H..._f....|
+| 23 14 07 f3 3f 2a 98 f3 6e fa e9 c3 88 b2 28 69 |#...?*..n.....(i|
+| d0 1f 35 35 20 24 f3 c5 7f 7e a4 55 ef ec 5c c2 |..55 $...~.U..\.|
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 fd 5a 18 31 d7 61 26 d4 |A........Z.1.a&.|
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+Client MAC key[20]:
+| b3 27 43 3d ac a3 8c 5f f6 a7 8c 6a 59 78 4c d1 |.'C=..._...jYxL.|
+| e9 5c de 6c |.\.l |
+Server MAC key[20]:
+| 37 db 48 db cb d1 5f 66 89 d3 97 bc 23 14 07 f3 |7.H..._f....#...|
+| 3f 2a 98 f3 |?*.. |
+Client Write key[24]:
+| 6e fa e9 c3 88 b2 28 69 d0 1f 35 35 20 24 f3 c5 |n.....(i..55 $..|
+| 7f 7e a4 55 ef ec 5c c2 |.~.U..\. |
+Server Write key[24]:
+| 0f 5b b3 f6 41 4b 63 1e e3 c6 bb ce d8 d3 7e b7 |.[..AKc.......~.|
+| 41 ad e2 ae b9 c7 c1 f7 |A....... |
+Client Write IV[8]:
+| fd 5a 18 31 d7 61 26 d4 |.Z.1.a&. |
+Server Write IV[8]:
+| 7b fe d8 95 c1 e3 ee 61 |{......a |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #143 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763...
+looking for RSA pre-master00806e8987be63f656f700ba3e954714c9a88a06f035968f...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 79 0b db 99 cb b2 ff d1 81 3c d5 b4 93 e9 a6 |!y........<.....|
+| 51 1d 52 d0 0d 8e 33 cc ca 5b 24 56 e8 52 34 bf |Q.R...3..[$V.R4.|
+| 21 bd e0 54 e6 9e ac 46 0e fe 55 77 10 0d f8 21 |!..T...F..Uw...!|
+| f5 6e 28 c7 63 f1 8a 08 1d 0a 83 52 8f |.n(.c......R. |
+hash out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+PRF out[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+key expansion[104]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 ae 02 2a 8b 57 bb 77 cb 20 36 42 86 |......*.W.w. 6B.|
+| bc ec cc f7 05 70 51 21 4d 74 91 6b 6c 13 a3 36 |.....pQ!Mt.kl..6|
+| bc c2 a1 42 0e 76 c1 62 95 0e b9 f3 36 f2 52 26 |...B.v.b....6.R&|
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b 62 d5 87 44 e9 69 99 06 |.r......b..D.i..|
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+Client MAC key[20]:
+| 3d 66 f3 de 08 89 3d e0 dc cd 0e 39 68 79 2b ec |=f....=....9hy+.|
+| e5 0e 88 85 |.... |
+Server MAC key[20]:
+| ae 02 2a 8b 57 bb 77 cb 20 36 42 86 bc ec cc f7 |..*.W.w. 6B.....|
+| 05 70 51 21 |.pQ! |
+Client Write key[24]:
+| 4d 74 91 6b 6c 13 a3 36 bc c2 a1 42 0e 76 c1 62 |Mt.kl..6...B.v.b|
+| 95 0e b9 f3 36 f2 52 26 |....6.R& |
+Server Write key[24]:
+| 1d 79 6d 59 93 73 af 8f 8e 8d 29 50 3c 81 74 d9 |.ymY.s....)P<.t.|
+| 06 72 1b 0e 85 8d bf 1b |.r...... |
+Client Write IV[8]:
+| 62 d5 87 44 e9 69 99 06 |b..D.i.. |
+Server Write IV[8]:
+| 8b 78 61 c4 92 94 1a 1c |.xa..... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3d b4 f8 fb 08 61 48 c4 35 e1 28 af e7 ea 2a a9 |=....aH.5.(...*.|
+| 4e 3a e1 25 ff 7b 89 56 76 de b6 5b f1 e5 1c 7f |N:.%.{.Vv..[....|
+| 37 eb 87 25 4b d8 3c 74 5f 61 5d 07 03 e2 12 88 |7..%K.<t_a].....|
+Plaintext[48]:
+| bc 0a 68 46 4e 95 79 6d 14 00 00 0c d4 ea 39 85 |..hFN.ym......9.|
+| 6c 0f 5b 03 09 83 4e 1a 54 f7 d5 f7 27 e1 ad be |l.[...N.T...'...|
+| cd be 19 cd b8 1d 31 71 80 66 94 5d 03 03 03 03 |......1q.f.]....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 54 f7 d5 f7 27 e1 ad be cd be 19 cd b8 1d 31 71 |T...'.........1q|
+| 80 66 94 5d |.f.] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #144 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e2 3d 49 9d 19 74 2f a1 66 a6 e3 df 85 95 eb c0 |.=I..t/.f.......|
+| ba b0 f4 81 8c 0a 2f 2c 69 4e 3a cd 8c 5b 22 88 |....../,iN:..[".|
+| 1e 35 c0 37 ac 07 7b 51 42 8f 9e f9 01 50 8c 71 |.5.7..{QB....P.q|
+Plaintext[48]:
+| eb 1f 06 e1 b5 08 4f ed 14 00 00 0c f0 02 47 0d |......O.......G.|
+| bf 59 da 5d c1 f2 ee 5d 6f 42 c4 e2 0d 73 c0 e6 |.Y.]...]oB...s..|
+| 93 45 ee 70 db f0 76 40 c6 b6 d7 04 03 03 03 03 |.E.p..v@........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6f 42 c4 e2 0d 73 c0 e6 93 45 ee 70 db f0 76 40 |oB...s...E.p..v@|
+| c6 b6 d7 04 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #145 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| f1 70 aa 76 6d 54 da 5f 3b df 55 c0 62 fe f4 4d |.p.vmT._;.U.b..M|
+| b0 f8 d9 f8 5f 82 ba dc 37 b6 db f2 6b 9e 29 44 |...._...7...k.)D|
+| b2 d4 04 04 73 c5 c7 5d d5 51 a9 d6 78 8b f8 b6 |....s..].Q..x...|
+| 80 5f f8 2f ff 71 1f ff 9a 79 c9 1f eb 32 f8 7f |._./.q...y...2..|
+| d8 85 f4 6f 0e 69 47 97 74 2f 72 9c 05 57 f9 b5 |...o.iG.t/r..W..|
+| e8 c7 ba 1e 8b 98 cc 24 0d 3b 2a 06 33 a2 de 67 |.......$.;*.3..g|
+| d8 5b 54 02 6d 50 2c 10 |.[T.mP,. |
+Plaintext[104]:
+| 00 07 22 1f 29 76 f6 80 47 45 54 20 2f 20 48 54 |..".)v..GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 64 73 73 2d 64 65 73 2d 63 62 63 33 2d 73 |h-dss-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 34 0d 0a |nsteyn.nl:4444..|
+| 0d 0a 96 9f 44 31 43 3b 0d 29 39 e8 f9 eb 8a d5 |....D1C;.)9.....|
+| d0 4e 5c 4b af db 01 01 |.N\K.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 76 76 10 c4 72 f9 ee 57 03 a4 f7 5a f8 07 8f |yvv..r..W...Z...|
+| 9d 11 4b ae |..K. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60402 found (nil)
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #146 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 48 80 aa 19 51 37 56 3a fe 0c ac c5 6a 89 88 41 |H...Q7V:....j..A|
+| 83 d7 41 29 5e ec bc 53 ae 2f 15 7f 20 51 37 d1 |..A)^..S./.. Q7.|
+| c9 45 97 9d cc 33 21 53 52 a6 cd 4c 0d ae 9c 35 |.E...3!SR..L...5|
+| bf 24 4d 95 21 fa db 64 45 2c 79 9c 50 05 62 e8 |.$M.!..dE,y.P.b.|
+| 40 f9 95 d2 4e c3 d4 73 a4 c6 ea ce 27 df d8 bb |@...N..s....'...|
+| 03 f4 b9 b7 b0 6d 0d ac 68 87 6e 0a 6c dd 2e a9 |.....m..h.n.l...|
+| 45 8f 56 80 7a 1c 1a 3a e4 1e 2e fc 5e 36 9e cf |E.V.z..:....^6..|
+| 27 04 c9 49 f4 c7 ee 5d 50 32 30 6e 97 0a 06 6c |'..I...]P20n...l|
+| 49 13 f4 dc f9 d9 4a ea f5 4a 6f 0e 85 73 e4 46 |I.....J..Jo..s.F|
+| 26 67 c3 66 37 eb 30 05 1f 7f 40 f9 9a ee 22 77 |&g.f7.0...@..."w|
+| e0 a8 7d e5 e4 bc fd 55 56 45 e0 9d a7 08 d7 20 |..}....UVE..... |
+| 19 d2 c4 b1 dc 44 a7 6e 24 94 e0 5f 16 52 0e 79 |.....D.n$.._.R.y|
+| 62 bf 29 6c 7a e7 6a 60 97 4c d8 6f fc d4 ed c0 |b.)lz.j`.L.o....|
+| c3 ab 1c 5d 61 3b c2 16 a9 9c a2 af 51 d9 3b 80 |...]a;......Q.;.|
+| 5a b6 76 1e bb 5a e8 14 5e b9 6b f8 fb 64 ea 86 |Z.v..Z..^.k..d..|
+| 86 63 d5 ef 0b c4 af 4d 13 6e 70 2d cf 84 66 1f |.c.....M.np-..f.|
+| 20 40 f7 8b f5 1d 74 97 3f 9f 64 ea 74 ee 1a c1 | @....t.?.d.t...|
+| 34 aa 95 f1 94 69 d2 46 11 59 94 eb da 4c 62 03 |4....i.F.Y...Lb.|
+| 2a 0e 5d 28 38 4e d2 2a 0f c3 35 47 fe ef 18 02 |*.](8N.*..5G....|
+| 3f ba 8a 16 fd d3 22 ad 2c a3 4e 5f 32 3b fa 06 |?.....".,.N_2;..|
+| be 2c 86 2d cc 04 cc 13 bb 74 74 06 ce 04 3f e6 |.,.-.....tt...?.|
+| 34 02 c0 12 d8 12 85 24 96 20 7d dc a7 ac c1 73 |4......$. }....s|
+| b5 86 3a 57 bd 36 b2 5d ab 1c 34 b6 25 ef 23 fd |..:W.6.]..4.%.#.|
+| 08 70 a1 18 f9 a0 e6 ee e3 0a 07 b5 be c1 4a f0 |.p............J.|
+Plaintext[384]:
+| 13 7e 91 e2 f6 09 fe 19 48 54 54 50 2f 31 2e 31 |.~......HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 33 |che....0x00,0x13|
+| 20 2d 20 45 44 48 2d 44 53 53 2d 44 45 53 2d 43 | - EDH-DSS-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 44 53 53 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |DSS Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e 55 7c 3d a5 5b 31 0f bd a7 68 12 1d |ipt>U|=.[1...h..|
+| 9e 1e 3e 8d c8 49 d9 fb 07 07 07 07 07 07 07 07 |..>..I..........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e3 e5 78 6d b1 ab a3 e1 9c 04 a9 ed c1 18 47 75 |..xm..........Gu|
+| 57 48 1a d0 |WH.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4444 found 0x342db00
+
+dissect_ssl enter frame #147 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 46 e5 ca 45 bf 17 ae 99 1d 63 48 ac 68 a7 8f c0 |F..E.....cH.h...|
+| 04 85 49 77 c6 f0 2f 07 6b 2b 96 29 da fa 7f 1c |..Iw../.k+.)....|
+Plaintext[32]:
+| 2b db 5a 85 9f 08 7d 2a 01 00 3f 62 e6 81 09 83 |+.Z...}*..?b....|
+| a1 cb 1c a7 6d c6 77 b2 12 61 c7 b2 b0 a1 01 01 |....m.w..a......|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3f 62 e6 81 09 83 a1 cb 1c a7 6d c6 77 b2 12 61 |?b........m.w..a|
+| c7 b2 b0 a1 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #149 (first time)
+ conversation = 0x7facef997a68, ssl_session = 0x7facc3824670
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 23 b5 78 ef 9c fd 59 77 25 f4 d1 11 9b 8a a6 4c |#.x...Yw%......L|
+| 3e de 4d 7c 56 4a e7 8d a1 ae 60 10 39 2d 24 3d |>.M|VJ....`.9-$=|
+Plaintext[32]:
+| d9 af 1f 9a d2 49 80 20 01 00 bf d8 8b 27 b3 fe |.....I. .....'..|
+| 69 fe e2 33 df ca 62 67 18 14 0d b9 2f fa 01 01 |i..3..bg..../...|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf d8 8b 27 b3 fe 69 fe e2 33 df ca 62 67 18 14 |...'..i..3..bg..|
+| 0d b9 2f fa |../. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #154 (first time)
+ssl_session_init: initializing ptr 0x7facc3826bb0 size 688
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34412 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4446
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #156 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0015 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 46 9a e5 b1 4d 01 d5 cb 62 ed f7 2e d7 98 f4 1c |F...M...b.......|
+| 9e 6d d9 5d 66 99 b7 8b 47 a7 ce a4 7d 54 37 07 |.m.]f...G...}T7.|
+| 71 b3 a0 a1 74 66 8b e4 f3 e2 8f c9 2c 5d 54 d9 |q...tf......,]T.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+PRF out[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+key expansion[72]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 81 3c 17 4b ea 5b 38 48 44 0b 95 49 |.....<.K.[8HD..I|
+| 33 e8 ed ec 28 b9 92 2c 5e be 00 1b 1d 30 f4 f0 |3...(..,^....0..|
+| 18 7b 14 b0 b8 28 b0 27 4a 42 80 b6 5c 6d 9a 3a |.{...(.'JB..\m.:|
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+Client MAC key[20]:
+| e1 a2 22 1a 07 d2 8b 66 7c 4f 68 0c 25 b0 73 26 |.."....f|Oh.%.s&|
+| 93 de f0 19 |.... |
+Server MAC key[20]:
+| 81 3c 17 4b ea 5b 38 48 44 0b 95 49 33 e8 ed ec |.<.K.[8HD..I3...|
+| 28 b9 92 2c |(.., |
+Client Write key[8]:
+| 5e be 00 1b 1d 30 f4 f0 |^....0.. |
+Server Write key[8]:
+| 18 7b 14 b0 b8 28 b0 27 |.{...(.' |
+Client Write IV[8]:
+| 4a 42 80 b6 5c 6d 9a 3a |JB..\m.: |
+Server Write IV[8]:
+| 41 99 c7 67 51 18 08 6b |A..gQ..k |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #158 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7ca...
+looking for RSA pre-master00802a0d0f85b40a6903ecad2f96c85838fd915f30332c23...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 b0 8d c0 81 33 2f d1 95 4f 87 08 d9 7d 75 26 |!....3/..O...}u&|
+| 45 57 2e d3 b0 05 fc 6e ca fb 7d 3b 84 52 34 bf |EW.....n..};.R4.|
+| 21 d7 fa 17 07 4e 94 fb 73 98 4c 4a c9 10 6b e5 |!....N..s.LJ..k.|
+| 53 a9 68 e7 ca ac f4 95 fc 4c dc 7a ef |S.h......L.z. |
+hash out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+PRF out[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+key expansion[72]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 66 4d c1 30 25 31 1f db f1 10 d5 01 |.\..fM.0%1......|
+| 8a c7 be e9 ed 6d bb 1d 19 6e cb 8b c1 4b be 46 |.....m...n...K.F|
+| 0e f1 af d3 a8 40 ab b9 5b ee 4b 96 c2 f2 fc e7 |.....@..[.K.....|
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+Client MAC key[20]:
+| c9 a1 98 83 27 96 86 50 c8 37 5c ee 46 a6 34 e9 |....'..P.7\.F.4.|
+| ab 5c aa 99 |.\.. |
+Server MAC key[20]:
+| 66 4d c1 30 25 31 1f db f1 10 d5 01 8a c7 be e9 |fM.0%1..........|
+| ed 6d bb 1d |.m.. |
+Client Write key[8]:
+| 19 6e cb 8b c1 4b be 46 |.n...K.F |
+Server Write key[8]:
+| 0e f1 af d3 a8 40 ab b9 |.....@.. |
+Client Write IV[8]:
+| 5b ee 4b 96 c2 f2 fc e7 |[.K..... |
+Server Write IV[8]:
+| c7 34 25 2e b3 54 ed 16 |.4%..T.. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| b3 b6 3f 49 fc 09 ff a9 48 23 89 ce eb 96 cb 40 |..?I....H#.....@|
+| f4 01 16 65 eb a2 9c 3b 07 06 b2 ce 19 74 84 f3 |...e...;.....t..|
+| fa 1d 36 49 64 a8 d9 07 9b f7 9c ee a2 6a 62 f7 |..6Id........jb.|
+Plaintext[48]:
+| 0d 58 46 d4 81 13 c3 af 14 00 00 0c a6 c3 1a 90 |.XF.............|
+| 66 71 e6 58 35 bf 82 67 4b 33 ee 3b 64 a4 1c 28 |fq.X5..gK3.;d..(|
+| 63 d1 e4 03 68 9f 8b d5 f6 a9 99 4d 03 03 03 03 |c...h......M....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4b 33 ee 3b 64 a4 1c 28 63 d1 e4 03 68 9f 8b d5 |K3.;d..(c...h...|
+| f6 a9 99 4d |...M |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #159 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| e3 a5 44 22 cf 49 d2 2c 86 74 db ca e4 89 2f eb |..D".I.,.t..../.|
+| 02 4d 14 46 12 6b f4 8d cd e8 e1 56 de 2c e9 b4 |.M.F.k.....V.,..|
+| 73 5b 3d ef 93 11 2f 22 e4 35 36 81 58 13 37 c0 |s[=.../".56.X.7.|
+Plaintext[48]:
+| 5a 53 b7 d8 09 0e 69 39 14 00 00 0c 89 dc 88 bc |ZS....i9........|
+| da 02 87 a9 e3 73 18 6d 8c 14 3d 07 e0 a6 ab 15 |.....s.m..=.....|
+| 47 60 d6 7f 57 f4 0e 6c 98 9c 03 79 03 03 03 03 |G`..W..l...y....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c 14 3d 07 e0 a6 ab 15 47 60 d6 7f 57 f4 0e 6c |..=.....G`..W..l|
+| 98 9c 03 79 |...y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #160 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 69 f8 b1 df d5 c9 14 65 da 4d dc cc cb 60 f6 70 |i......e.M...`.p|
+| 17 ce 72 33 63 28 75 31 47 d9 60 e7 86 1e 24 43 |..r3c(u1G.`...$C|
+| 1e 2f 8a 28 1c d1 af d7 62 7e 48 f7 4a 97 37 2d |./.(....b~H.J.7-|
+| 2c d6 31 92 cd e1 e6 aa 04 ea 83 49 6f 7e 86 e2 |,.1........Io~..|
+| e0 6a 91 b3 23 96 cf 14 ec 3d 74 41 ac 9b 87 ed |.j..#....=tA....|
+| 20 30 2b e6 4c 29 42 19 05 f9 7b 79 68 6e 6d 7a | 0+.L)B...{yhnmz|
+| a1 45 ab 4f 5b e0 12 5e |.E.O[..^ |
+Plaintext[104]:
+| e4 17 15 58 70 29 4b ad 47 45 54 20 2f 20 48 54 |...Xp)K.GET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 2d 73 68 |h-rsa-des-cbc-sh|
+| 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e |a.local.al.leken|
+| 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 36 0d 0a 0d |steyn.nl:4446...|
+| 0a b7 db 5d 0e f4 87 18 bc e9 71 24 4f 65 b0 34 |...]......q$Oe.4|
+| 88 b9 9b f3 f4 02 02 02 |........ |
+ssl_decrypt_record found padding 2 final len 101
+checking mac (len 73, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4c f5 c4 9e d5 1d 75 68 cc fb 2a dd e2 ef c0 81 |L.....uh..*.....|
+| 11 ca 8b e4 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34412 found (nil)
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #161 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| 96 f2 81 e6 42 8c 20 31 a7 de b2 81 4a 35 4d 95 |....B. 1....J5M.|
+| 68 85 5d 50 c9 22 9c e8 0d 87 8f 3f ec 03 58 3d |h.]P.".....?..X=|
+| 39 b0 25 3b 99 d6 7f 3a ca 77 29 72 89 5c 3b 46 |9.%;...:.w)r.\;F|
+| 22 d9 13 ca 53 aa 28 bc 13 07 9a 36 db 38 3b ca |"...S.(....6.8;.|
+| 8a 48 a0 12 1b 90 80 38 7f 14 d8 a6 be fb 63 15 |.H.....8......c.|
+| 12 56 44 dd 21 5a 6e 36 1a fb 12 b0 ae 9c 4b a3 |.VD.!Zn6......K.|
+| b3 2f e9 42 d1 e9 48 45 ec 26 91 52 01 dc fa a6 |./.B..HE.&.R....|
+| 58 1e 0f 49 b0 cd 7d d0 99 f0 e1 86 43 c6 f8 84 |X..I..}.....C...|
+| f2 7a f9 31 c5 cb d6 3d 55 f9 81 e2 cf 33 3f 66 |.z.1...=U....3?f|
+| 23 af 96 71 ab 28 9d c9 42 99 7a 33 f9 d0 38 07 |#..q.(..B.z3..8.|
+| 8e d5 35 e8 68 a5 0f 53 21 08 ef 18 08 46 de 67 |..5.h..S!....F.g|
+| 1d 30 d6 9c 33 fa 98 91 55 fc 53 fc 44 9e a6 79 |.0..3...U.S.D..y|
+| 4d 90 53 aa b5 3e 0a d1 04 5e 4d 7e 27 d4 1b 87 |M.S..>...^M~'...|
+| 27 e0 18 1b e3 40 e1 a4 1c fb e7 5e 97 91 ba 15 |'....@.....^....|
+| 3e 76 f5 57 66 4b 15 ee 79 43 60 60 18 05 8e 52 |>v.WfK..yC``...R|
+| 11 2f ae 8c 06 44 a5 e5 ac 51 12 b2 7a b1 d4 10 |./...D...Q..z...|
+| 1d 3b f3 55 c4 ce de d0 71 a5 6a 4e eb 44 23 d6 |.;.U....q.jN.D#.|
+| 4e 75 49 46 7f c9 86 70 b1 64 5f 8e b5 5e 2b 1c |NuIF...p.d_..^+.|
+| 63 bb 83 00 f7 8e 88 b7 10 1e 50 6e f5 06 0a d4 |c.........Pn....|
+| 1a 27 a2 c8 c6 61 b9 39 a8 ee 82 1d 6f 18 b1 6d |.'...a.9....o..m|
+| 69 cd a5 0e 0e c3 ba 50 c0 de 12 d0 d5 51 70 57 |i......P.....QpW|
+| 09 02 d0 f2 71 aa 21 fc 39 de 0b 60 bf da fd 4f |....q.!.9..`...O|
+| f7 00 7e 32 03 d6 13 22 f2 07 a9 a6 23 e6 d2 13 |..~2..."....#...|
+| 45 cb 55 41 f6 5b 44 df a0 f6 64 4c 9c 2b 79 e7 |E.UA.[D...dL.+y.|
+Plaintext[384]:
+| 76 ac 3b fa b1 54 fa 6a 48 54 54 50 2f 31 2e 31 |v.;..T.jHTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 35 |che....0x00,0x15|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 2d 53 48 41 20 20 20 20 20 53 53 4c 76 33 |BC-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 44 45 53 28 35 36 29 |RSA Enc=DES(56)|
+| 20 20 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 | Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e ef e0 8d f6 e3 0b ba 9e 8c ff 31 a8 |ipt>..........1.|
+| 60 89 37 f1 94 ad fd a2 07 07 07 07 07 07 07 07 |`.7.............|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c6 8e 88 6c 4a 0d 2f 24 5a e6 9d 8b ed 1c 68 0f |...lJ./$Z.....h.|
+| 59 41 2e 7d |YA.} |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4446 found 0x342dc20
+
+dissect_ssl enter frame #162 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 90 f6 07 04 e0 4a 07 59 f3 0d 7c 9d c1 fc d7 8a |.....J.Y..|.....|
+| fb d1 9d 5f 88 e9 38 90 30 0f 6f e4 69 5d 4a 1a |..._..8.0.o.i]J.|
+Plaintext[32]:
+| 0c 1a e1 d4 78 6a da 00 01 00 9c 5a 40 9d db f4 |....xj.....Z@...|
+| 05 13 fa 7e 0e cd 31 cd 8d d0 df 9c 0a da 01 01 |...~..1.........|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 5a 40 9d db f4 05 13 fa 7e 0e cd 31 cd 8d d0 |.Z@......~..1...|
+| df 9c 0a da |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #164 (first time)
+ conversation = 0x7facef997d10, ssl_session = 0x7facc3826bb0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 7d d7 c0 e6 96 9e 50 c3 7f d0 b5 0d cc dd 53 da |}.....P.......S.|
+| 00 42 4e 39 07 ec 5e 40 5f 00 f0 c5 3b 4c 04 78 |.BN9..^@_...;L.x|
+Plaintext[32]:
+| e2 0d bf b8 8a be e4 0b 01 00 de 63 97 d3 6f d6 |...........c..o.|
+| ad f1 c0 fc 08 53 a9 a7 e9 d6 c5 46 d0 da 01 01 |.....S.....F....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de 63 97 d3 6f d6 ad f1 c0 fc 08 53 a9 a7 e9 d6 |.c..o......S....|
+| c5 46 d0 da |.F.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #169 (first time)
+ssl_session_init: initializing ptr 0x7facc38290b0 size 688
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34630 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4447
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #171 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0016 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 93 57 83 6f 16 f7 a5 bf 81 77 73 ad 7a b1 b1 12 |.W.o.....ws.z...|
+| 81 76 e6 9a ee b2 90 1a 5a e4 e8 d2 9d c1 76 cb |.v......Z.....v.|
+| e6 a2 ec 75 23 b3 7a 3d da 7a 69 4a 52 34 3a 66 |...u#.z=.ziJR4:f|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+PRF out[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+key expansion[104]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 |&B.....A.j.~.#CR|
+| fe 14 37 f3 bd 43 0e af e9 bf 44 8f 11 9c 68 9a |..7..C....D...h.|
+| d3 37 a3 40 39 62 09 8b b8 79 3b 5e d1 73 93 10 |.7.@9b...y;^.s..|
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 cc bd 9c 99 62 ff 6c e8 |...~h..Y....b.l.|
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+Client MAC key[20]:
+| 18 d3 be 2d a9 e6 77 5d a9 5d f5 47 1e b4 bd 4e |...-..w].].G...N|
+| 26 42 00 bb |&B.. |
+Server MAC key[20]:
+| 04 ad ef 41 e2 6a ce 7e 1d 23 43 52 fe 14 37 f3 |...A.j.~.#CR..7.|
+| bd 43 0e af |.C.. |
+Client Write key[24]:
+| e9 bf 44 8f 11 9c 68 9a d3 37 a3 40 39 62 09 8b |..D...h..7.@9b..|
+| b8 79 3b 5e d1 73 93 10 |.y;^.s.. |
+Server Write key[24]:
+| 45 e1 04 d8 96 76 ba 0f 1e e5 85 48 8e e0 6b 84 |E....v.....H..k.|
+| 96 d0 cf 7e 68 0f de 59 |...~h..Y |
+Client Write IV[8]:
+| cc bd 9c 99 62 ff 6c e8 |....b.l. |
+Server Write IV[8]:
+| a9 0f 68 6e f7 bc a7 ea |..hn.... |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #173 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 198
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312...
+looking for RSA pre-master008027b568fcd473db04087fdc9b05310f3c92161bfb26f1...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 21 03 e0 5e 34 06 5a 8f 2a 18 34 6f 0b ba aa 8f |!..^4.Z.*.4o....|
+| 16 f9 df b8 62 39 f7 4f 32 ee 15 c2 25 52 34 bf |....b9.O2...%R4.|
+| 21 62 eb cc a4 df 9d d8 a8 5b ef 60 a5 f3 2a d9 |!b.......[.`..*.|
+| 47 50 d7 93 12 a7 9e 81 d0 e2 83 1c 5b |GP..........[ |
+hash out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+PRF out[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+key expansion[104]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 7e fb 12 39 31 6f ee 5b 60 90 90 b6 |VO..~..91o.[`...|
+| 77 e0 70 41 92 17 12 71 5e ed bf 9a a0 fe 96 7f |w.pA...q^.......|
+| d5 7b 92 8d 8c b3 5e 40 78 f7 06 49 d9 c2 4f 90 |.{....^@x..I..O.|
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 7f 2b 21 ed eb 3c b3 bb |z.|..*.!.+!..<..|
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+Client MAC key[20]:
+| 36 d1 03 18 89 dc fb c9 6e 87 79 3d d6 fe ae 08 |6.......n.y=....|
+| 56 4f 14 f0 |VO.. |
+Server MAC key[20]:
+| 7e fb 12 39 31 6f ee 5b 60 90 90 b6 77 e0 70 41 |~..91o.[`...w.pA|
+| 92 17 12 71 |...q |
+Client Write key[24]:
+| 5e ed bf 9a a0 fe 96 7f d5 7b 92 8d 8c b3 5e 40 |^........{....^@|
+| 78 f7 06 49 d9 c2 4f 90 |x..I..O. |
+Server Write key[24]:
+| 59 38 d8 45 60 b7 fe d5 7c d6 12 f7 a9 37 75 a0 |Y8.E`...|....7u.|
+| 7a d3 7c 8c a7 2a bc 21 |z.|..*.! |
+Client Write IV[8]:
+| 7f 2b 21 ed eb 3c b3 bb |.+!..<.. |
+Server Write IV[8]:
+| d8 3b 55 b8 c3 02 7a ca |.;U...z. |
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: 3DES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 30 b9 99 b5 98 3a 51 ba 34 9f 5f c3 fa 03 14 a5 |0....:Q.4._.....|
+| ff 2b 4c e7 1d 75 8e 9b 9f 7e 1a f7 9c 04 c5 7b |.+L..u...~.....{|
+| ef 9d e7 8d d3 52 a8 f2 60 1e 56 3e 94 1c 79 75 |.....R..`.V>..yu|
+Plaintext[48]:
+| 11 54 ba b8 2b 47 c3 13 14 00 00 0c d4 0c 3a 75 |.T..+G........:u|
+| 2f ae 37 1c 80 8e f4 b6 bf eb f9 f3 74 05 e3 b2 |/.7.........t...|
+| 8a 91 5f 39 26 39 24 10 89 96 19 d6 03 03 03 03 |.._9&9$.........|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf eb f9 f3 74 05 e3 b2 8a 91 5f 39 26 39 24 10 |....t....._9&9$.|
+| 89 96 19 d6 |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #174 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 234
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 59
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 53
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 43 b9 41 64 c5 c1 70 d9 95 40 43 89 6d 6a 0f 7e |C.Ad..p..@C.mj.~|
+| 1f b0 d1 8b 8e cc 05 85 5e 1d 64 05 7f c3 18 6c |........^.d....l|
+| 1b 6f fb 98 8c 36 f4 92 5f 58 6d 29 af b8 1b b3 |.o...6.._Xm)....|
+Plaintext[48]:
+| 3e 8c 1e 41 11 1c 02 94 14 00 00 0c b1 af 5a f7 |>..A..........Z.|
+| 46 79 f1 9d 13 16 f8 d6 77 48 26 28 97 92 87 35 |Fy......wH&(...5|
+| 2e 9a 77 58 79 64 5d 3f 37 26 30 58 03 03 03 03 |..wXyd]?7&0X....|
+ssl_decrypt_record found padding 3 final len 44
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 77 48 26 28 97 92 87 35 2e 9a 77 58 79 64 5d 3f |wH&(...5..wXyd]?|
+| 37 26 30 58 |7&0X |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #175 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 109
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 104, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 104
+Ciphertext[104]:
+| 52 25 de 8e dc 51 1e 44 7a 04 36 3a fe f7 5a 2a |R%...Q.Dz.6:..Z*|
+| f8 c6 0a 28 6a be ce 44 47 9c 36 9c d8 16 86 a8 |...(j..DG.6.....|
+| b5 23 27 08 96 eb 4c dc 09 0d 57 27 71 3f 75 cb |.#'...L...W'q?u.|
+| 04 3f 78 fa a6 3c 32 bc ec 2a 1e 66 71 b3 22 bd |.?x..<2..*.fq.".|
+| b7 0a bd 82 68 aa 70 a1 cd 99 a9 70 c8 cd 74 a5 |....h.p....p..t.|
+| ad 7f 52 6f d0 71 4e 94 d3 09 dc 9f 01 d5 d2 4e |..Ro.qN........N|
+| f9 48 cc ac 0a 66 40 37 |.H...f@7 |
+Plaintext[104]:
+| c8 61 50 07 a9 8d 67 44 47 45 54 20 2f 20 48 54 |.aP...gDGET / HT|
+| 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 65 64 |TP/1.1..Host: ed|
+| 68 2d 72 73 61 2d 64 65 73 2d 63 62 63 33 2d 73 |h-rsa-des-cbc3-s|
+| 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 |ha.local.al.leke|
+| 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 34 37 0d 0a |nsteyn.nl:4447..|
+| 0d 0a 4d a5 7b 38 2e 13 89 3f e6 db 22 e5 fa 38 |..M.{8...?.."..8|
+| f2 c8 c6 33 1e c6 01 01 |...3.... |
+ssl_decrypt_record found padding 1 final len 102
+checking mac (len 74, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5d 2f 5b bd d8 8f 3f f3 2f 99 b0 8a ef fc 8b df |]/[...?./.......|
+| a4 d6 01 22 |..." |
+ssl_decrypt_record: mac failed
+association_find: TCP port 34630 found (nil)
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #176 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 389
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 384, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 384
+Ciphertext[384]:
+| c6 a7 90 28 b2 f1 b7 15 43 62 7a 8e 57 14 47 11 |...(....Cbz.W.G.|
+| 8b 43 bb 7f c5 53 21 ef 53 53 a5 a0 11 37 66 6f |.C...S!.SS...7fo|
+| 1a db 78 e4 e2 3c 2e 19 51 bb ec 08 06 33 6e ac |..x..<..Q....3n.|
+| c8 96 d3 5d 06 de 57 71 89 ad 14 97 38 9f f2 f2 |...]..Wq....8...|
+| 05 06 8c 49 c0 00 0f 08 de 60 e2 2c ed 57 bd 7a |...I.....`.,.W.z|
+| b0 75 2e 8f 92 28 5e 0a 49 ef 83 86 4f 05 eb f9 |.u...(^.I...O...|
+| f5 4a 7a 69 e2 bc d5 be 68 c7 52 b9 3c 98 b3 50 |.Jzi....h.R.<..P|
+| ae b3 de 52 cc a7 61 fd bf af a9 f0 e3 cc d6 54 |...R..a........T|
+| 9b 45 a5 94 26 58 87 cf 51 63 aa 82 56 9b 3e b1 |.E..&X..Qc..V.>.|
+| fe 6f 12 74 f2 1c ae 8b 7c 7b bd a4 c0 d0 6f 17 |.o.t....|{....o.|
+| b9 50 61 6e 51 02 32 19 54 1a 57 a2 d5 9e a5 0a |.PanQ.2.T.W.....|
+| 14 3c e9 f7 11 84 7d ad e8 d7 7d 0c 07 4c 3f 57 |.<....}...}..L?W|
+| ac 44 b8 a9 f0 c7 2e db 53 12 81 99 4a 0e 6a e4 |.D......S...J.j.|
+| c6 fb 54 9b bf 9a c3 e2 a9 f0 68 34 c3 95 74 34 |..T.......h4..t4|
+| 6c f2 8c 77 3d 57 b7 a0 c3 f8 cd 04 5b 15 5e 41 |l..w=W......[.^A|
+| 53 13 85 50 fc 72 27 a2 7b 84 0b b1 66 9b a5 eb |S..P.r'.{...f...|
+| 35 ad e4 cf fa 58 29 07 78 79 f5 14 c0 34 2d b2 |5....X).xy...4-.|
+| a2 b9 25 1c 87 83 63 13 c3 60 87 b7 c9 94 5f 10 |..%...c..`...._.|
+| 4e 5a 94 63 18 2f 23 39 1b 0e f3 d5 13 27 a8 a5 |NZ.c./#9.....'..|
+| 51 9f 1c e3 c1 6e 24 b7 c6 ec 19 a2 8b a0 37 8e |Q....n$.......7.|
+| 3e 5e da aa 5e 37 9f 36 c6 d3 33 15 96 a2 7b 62 |>^..^7.6..3...{b|
+| 63 1b 6a af 83 e8 48 71 77 92 13 49 5f 09 53 5a |c.j...Hqw..I_.SZ|
+| 81 b0 a7 be 34 02 fe dd 05 41 32 91 41 df 80 9a |....4....A2.A...|
+| 4e 78 88 1c a7 90 dd 6a 98 9b ec a0 73 0c 1a 1a |Nx.....j....s...|
+Plaintext[384]:
+| 15 08 3a 52 13 84 ff 32 48 54 54 50 2f 31 2e 31 |..:R...2HTTP/1.1|
+| 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a | 200 OK..Server:|
+| 20 6e 67 69 6e 78 2f 31 2e 34 2e 32 0d 0a 44 61 | nginx/1.4.2..Da|
+| 74 65 3a 20 53 61 74 2c 20 31 34 20 53 65 70 20 |te: Sat, 14 Sep |
+| 32 30 31 33 20 31 39 3a 35 35 3a 31 33 20 47 4d |2013 19:55:13 GM|
+| 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |T..Content-Type:|
+| 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 | text/html..Cont|
+| 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 34 31 0d |ent-Length: 141.|
+| 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f |.Connection: clo|
+| 73 65 0d 0a 45 78 70 69 72 65 73 3a 20 54 68 75 |se..Expires: Thu|
+| 2c 20 30 31 20 4a 61 6e 20 31 39 37 30 20 30 30 |, 01 Jan 1970 00|
+| 3a 30 30 3a 30 31 20 47 4d 54 0d 0a 43 61 63 68 |:00:01 GMT..Cach|
+| 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 |e-Control: no-ca|
+| 63 68 65 0d 0a 0d 0a 30 78 30 30 2c 30 78 31 36 |che....0x00,0x16|
+| 20 2d 20 45 44 48 2d 52 53 41 2d 44 45 53 2d 43 | - EDH-RSA-DES-C|
+| 42 43 33 2d 53 48 41 20 20 20 20 53 53 4c 76 33 |BC3-SHA SSLv3|
+| 20 4b 78 3d 44 48 20 20 20 20 20 20 20 41 75 3d | Kx=DH Au=|
+| 52 53 41 20 20 45 6e 63 3d 33 44 45 53 28 31 36 |RSA Enc=3DES(16|
+| 38 29 20 4d 61 63 3d 53 48 41 31 3c 73 63 72 69 |8) Mac=SHA1<scri|
+| 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 |pt>document.doma|
+| 69 6e 3d 27 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b |in='local.al.lek|
+| 65 6e 73 74 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 |ensteyn.nl'</scr|
+| 69 70 74 3e e2 99 45 65 8c 16 05 3b 22 43 65 8b |ipt>..Ee...;"Ce.|
+| bb 26 09 2a 69 d1 2c 94 07 07 07 07 07 07 07 07 |.&.*i.,.........|
+ssl_decrypt_record found padding 7 final len 376
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6e 38 8e 36 a4 fc f7 22 c3 52 d5 c3 70 e0 30 e9 |n8.6...".R..p.0.|
+| fc bb 46 de |..F. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4447 found 0x342dcb0
+
+dissect_ssl enter frame #177 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 55 ee a8 58 43 84 d9 46 e9 af a2 07 a7 c0 5a e5 |U..XC..F......Z.|
+| 9b f6 7e d0 b3 3d 25 37 88 45 a1 00 c8 e7 dc be |..~..=%7.E......|
+Plaintext[32]:
+| 28 c5 00 a5 16 dd 5e e0 01 00 d3 7a ba cf ea 38 |(.....^....z...8|
+| ec 1b 2d ef 78 0d 34 2f 3c 11 c4 bf 08 70 01 01 |..-.x.4/<....p..|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d3 7a ba cf ea 38 ec 1b 2d ef 78 0d 34 2f 3c 11 |.z...8..-.x.4/<.|
+| c4 bf 08 70 |...p |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #179 (first time)
+ conversation = 0x7facef997fb8, ssl_session = 0x7facc38290b0
+ record: offset = 0, reported_length_remaining = 37
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 32, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 32
+Ciphertext[32]:
+| 76 68 33 16 36 aa 6b 09 b6 a9 34 b1 61 c6 fb e3 |vh3.6.k...4.a...|
+| b3 8d dd 81 3c e8 4e 02 9b 85 fe 37 c5 24 96 97 |....<.N....7.$..|
+Plaintext[32]:
+| f2 a4 38 4d 1e 1c 93 cd 01 00 a9 6f f3 6d 2b ba |..8M.......o.m+.|
+| a6 3d 8a 8c 6b 65 e4 84 4c 61 1e 50 86 a7 01 01 |.=..ke..La.P....|
+ssl_decrypt_record found padding 1 final len 30
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a9 6f f3 6d 2b ba a6 3d 8a 8c 6b 65 e4 84 4c 61 |.o.m+..=..ke..La|
+| 1e 50 86 a7 |.P.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #184 (first time)
+ssl_session_init: initializing ptr 0x7facc382b5b0 size 688
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56585 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4448
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #186 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x002F -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 25 73 16 cf 74 a7 82 52 52 74 72 8f f1 d5 d1 a9 |%s..t..RRtr.....|
+| 02 5a d8 f4 d7 ec f5 43 2d 23 3d 87 4c df 0d 4d |.Z.....C-#=.L..M|
+| 0c 5b ad 7f 65 f8 e9 49 3f a8 10 76 c0 03 39 02 |.[..e..I?..v..9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+PRF out[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+key expansion[104]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa |........."v.....|
+| ad d1 8c e4 18 60 e9 b7 17 32 20 aa 71 e4 51 58 |.....`...2 .q.QX|
+| de 29 07 4f ff 5f 42 28 d3 6a 06 82 7d 52 e0 44 |.).O._B(.j..}R.D|
+| ee 97 db df 7c c4 f5 41 20 8e 7e 43 da 31 84 17 |....|..A .~C.1..|
+| ac 47 27 8a 28 19 f1 07 22 b5 68 ef 27 e0 f2 e4 |.G'.(...".h.'...|
+| ed cc 53 e8 a9 38 28 61 |..S..8(a |
+Client MAC key[20]:
+| b8 c8 ef 24 ff 89 0d db a5 13 0e f9 41 d3 5e 67 |...$........A.^g|
+| 93 87 13 02 |.... |
+Server MAC key[20]:
+| 07 f9 81 ce c2 22 76 b6 9b 18 c9 aa ad d1 8c e4 |....."v.........|
+| 18 60 e9 b7 |.`.. |
+Client Write key[16]:
+| 17 32 20 aa 71 e4 51 58 de 29 07 4f ff 5f 42 28 |.2 .q.QX.).O._B(|
+Server Write key[16]:
+| d3 6a 06 82 7d 52 e0 44 ee 97 db df 7c c4 f5 41 |.j..}R.D....|..A|
+Client Write IV[16]:
+| 20 8e 7e 43 da 31 84 17 ac 47 27 8a 28 19 f1 07 | .~C.1...G'.(...|
+Server Write IV[16]:
+| 22 b5 68 ef 27 e0 f2 e4 ed cc 53 e8 a9 38 28 61 |".h.'.....S..8(a|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #188 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b45632...
+looking for RSA pre-master9c6ff5543ffe32d8ea3a28bd01a06a2390bf507ff9296aa5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 0b 60 48 82 dd df 5c da e5 be 82 fd 4a 9c |"..`H...\.....J.|
+| 6e f5 3f 8d 63 98 82 36 66 8a 36 49 62 52 34 bf |n.?.c..6f.6IbR4.|
+| 22 b7 64 92 8c ba fa b0 8f f1 01 c0 11 e0 e2 3e |".d............>|
+| a0 d3 b4 56 32 5d f1 d9 ad 5b e3 5b 36 |...V2]...[.[6 |
+hash out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+PRF out[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+key expansion[104]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 |...Q.>m_.U_.....|
+| 52 0a 0e 02 08 16 57 da ab 14 c4 af 42 91 20 e7 |R.....W.....B. .|
+| 7b ab 41 ae 53 6e cd f4 0c bc fb 0d 51 58 b0 25 |{.A.Sn......QX.%|
+| f8 2f ad 6d 7f 2a 02 13 88 73 65 2e c7 b4 3d 1c |./.m.*...se...=.|
+| 94 d0 61 28 cb 66 35 71 8d 3c 54 51 6b a4 ad 6e |..a(.f5q.<TQk..n|
+| b9 f8 29 05 96 08 f3 3a |..)....: |
+Client MAC key[20]:
+| ab 24 9e 1c 8b e4 d0 cb 6f 12 9e a3 77 70 ba 5d |.$......o...wp.]|
+| 9c f8 f6 51 |...Q |
+Server MAC key[20]:
+| b5 3e 6d 5f d4 55 5f c1 91 dd a9 08 52 0a 0e 02 |.>m_.U_.....R...|
+| 08 16 57 da |..W. |
+Client Write key[16]:
+| ab 14 c4 af 42 91 20 e7 7b ab 41 ae 53 6e cd f4 |....B. .{.A.Sn..|
+Server Write key[16]:
+| 0c bc fb 0d 51 58 b0 25 f8 2f ad 6d 7f 2a 02 13 |....QX.%./.m.*..|
+Client Write IV[16]:
+| 88 73 65 2e c7 b4 3d 1c 94 d0 61 28 cb 66 35 71 |.se...=...a(.f5q|
+Server Write IV[16]:
+| 8d 3c 54 51 6b a4 ad 6e b9 f8 29 05 96 08 f3 3a |.<TQk..n..)....:|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c4 5f 91 3d 25 a3 a0 22 e2 b3 ce d7 2f bc a8 c4 |._.=%.."..../...|
+| cb c5 84 32 41 c8 2b 56 21 8a 35 52 8d 10 75 8e |...2A.+V!.5R..u.|
+| 88 64 2e 9f d2 3d de 0b 9f 0c 81 7b 8d 4d 84 7d |.d...=.....{.M.}|
+| 13 f2 7a de a0 b1 7c f2 49 47 a3 1d 54 d8 21 c2 |..z...|.IG..T.!.|
+Plaintext[64]:
+| 42 32 46 39 d0 4d be 41 8f fd 10 5c 03 8d bd e5 |B2F9.M.A...\....|
+| 14 00 00 0c d7 7e 6a cc d7 b3 00 df 6d b0 63 5c |.....~j.....m.c\|
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..3#............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc 88 c6 58 79 79 94 70 2c c0 96 b2 46 46 3b b8 |...Xyy.p,...FF;.|
+| 9c 03 33 23 |..3# |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #189 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| c1 95 8f 38 a1 6a 07 72 17 43 58 54 ce 3a 60 16 |...8.j.r.CXT.:`.|
+| 81 0e 88 88 0c 61 ef 44 7d f2 42 30 f5 3b 3b ed |.....a.D}.B0.;;.|
+| a6 d6 ad 17 8d 28 b9 83 3f 0a 28 5c 52 14 10 6a |.....(..?.(\R..j|
+| 99 3f 04 51 28 5f 2a c8 73 bc 67 8d b5 bb e3 00 |.?.Q(_*.s.g.....|
+Plaintext[64]:
+| 7a 52 ad d1 45 cd ea e1 f0 72 5d 2d d8 ec 3b c0 |zR..E....r]-..;.|
+| 14 00 00 0c 85 21 68 ab 47 e2 12 2b 15 da 6e 75 |.....!h.G..+..nu|
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.is.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 ed 97 a5 ed e6 97 53 8a ca f2 f2 f1 e1 96 ab |.......S........|
+| 9d 69 73 dc |.is. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #190 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| e1 38 a1 61 b3 19 97 8a bc 0f 7b c6 39 7f 51 73 |.8.a......{.9.Qs|
+| e3 3f c7 f3 a9 cc 79 13 3a fa c8 4e f4 32 a5 2e |.?....y.:..N.2..|
+| 03 da a6 93 d0 62 a3 4c 69 b2 8e 0d 79 8f 63 ec |.....b.Li...y.c.|
+| f3 dc fd da cc 76 d3 ab 35 10 21 22 ef 16 f1 5d |.....v..5.!"...]|
+| a8 e8 35 a7 88 77 fc 30 c1 a9 cc 2a 6f 2d 3b 16 |..5..w.0...*o-;.|
+| 18 81 40 b2 41 6a e7 b5 27 6b 9b 13 97 39 9e 9e |..@.Aj..'k...9..|
+| 9b 64 79 71 19 73 c6 6b 3b 29 5a a9 b0 a0 ec 24 |.dyq.s.k;)Z....$|
+Plaintext[112]:
+| f7 fe 40 28 7b 7e 0b 38 a1 02 cd 75 e6 1c 3e 78 |..@({~.8...u..>x|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 31 32 38 2d 73 68 61 |Host: aes128-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 34 38 0d 0a 0d 0a |teyn.nl:4448....|
+| 90 ab af 77 9f 92 99 2f 13 ca b2 56 b2 0a 6c 6a |...w.../...V..lj|
+| af 9c 0b fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cc ad 88 d7 c0 ce ec 90 81 5c f5 2b dd 8b 99 6e |.........\.+...n|
+| 3b be 1b 69 |;..i |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56585 found (nil)
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #191 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 18 93 55 f3 49 26 2e 7f e3 2e 94 24 ca 57 3a 5b |..U.I&.....$.W:[|
+| 21 e3 43 4d bf 63 46 ee e3 6a e9 07 96 68 30 57 |!.CM.cF..j...h0W|
+| 94 15 f0 2c 57 37 23 39 2f f7 bc cd fb 4d 15 8f |...,W7#9/....M..|
+| f6 88 0d 09 fa 08 ab 34 fd b9 59 1b 4b 4a ee 81 |.......4..Y.KJ..|
+| 1d e9 14 80 1a 89 68 bf e0 2e 69 53 b9 17 00 96 |......h...iS....|
+| a1 69 1d 6e 69 0e 2a 0f 1e 82 d1 56 2d 05 64 31 |.i.ni.*....V-.d1|
+| e4 44 a4 4f fa 23 a6 fc 68 32 be 15 f6 b9 ac 6f |.D.O.#..h2.....o|
+| 19 30 ea 4d a1 08 04 65 03 17 91 88 b6 0e be 78 |.0.M...e.......x|
+| ec 3e 35 d7 89 dd d1 5b 16 b9 ac 75 2c 7e e7 ab |.>5....[...u,~..|
+| 50 4f b7 73 ca 30 fd f6 a1 4c c9 ab 85 08 5e 09 |PO.s.0...L....^.|
+| 71 b5 bf ee 5e b0 92 06 0a 43 5b c7 16 f3 71 ab |q...^....C[...q.|
+| ed ae 5f e2 2d 8e d1 2d 45 ba 20 aa 4f ce ad 60 |.._.-..-E. .O..`|
+| 33 9d b0 7f dd 4e 60 c0 18 52 92 1b 72 98 d6 79 |3....N`..R..r..y|
+| 9a a5 18 fc 48 73 77 42 10 dc 13 20 55 16 cb ec |....HswB... U...|
+| 61 c5 71 86 fa 22 9b f2 a5 f0 ed 54 cb 96 a1 4d |a.q..".....T...M|
+| e3 af 35 c0 98 48 86 2a 7c 20 60 61 f2 82 6b 06 |..5..H.*| `a..k.|
+| 9b e1 9b 28 8a 99 8b c8 be 95 6b f6 76 c5 89 fb |...(......k.v...|
+| 3c 60 01 ed 6b 44 df 94 dd f8 9e cc a2 01 30 02 |<`..kD........0.|
+| 9f 71 30 82 33 21 89 92 02 d1 e5 bf f6 8a 94 f8 |.q0.3!..........|
+| bc 21 09 a0 c1 9f aa 0a 6d 82 43 0a e4 a0 a5 59 |.!......m.C....Y|
+| b4 e0 38 26 6e 13 03 61 d1 2e bc ab 61 94 c2 0d |..8&n..a....a...|
+| 60 b8 d4 92 73 3a bf f8 90 ee f9 92 f5 3d 10 57 |`...s:.......=.W|
+| 68 a8 65 11 94 be b2 4c 7a d7 72 a7 56 b0 15 71 |h.e....Lz.r.V..q|
+| 3f cd 2f 1a c4 c9 3f 27 d0 bc 0f aa fa b2 14 81 |?./...?'........|
+| f2 e2 ac 23 1d 5d 6e 09 34 b8 b9 ee 35 29 93 e0 |...#.]n.4...5)..|
+Plaintext[400]:
+| 1b bd f3 c6 cc 1c 1c f8 eb af 5e 18 ba bd c3 40 |..........^....@|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 32 46 20 2d 20 41 45 53 31 32 |x00,0x2F - AES12|
+| 38 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |8-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9b 46 ca 65 |nl'</script>.F.e|
+| 92 cf d8 33 79 d6 e7 4c 0e 7a 91 81 cc 1b 00 43 |...3y..L.z.....C|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 55 4f b0 3a ac 07 a7 cb 7e f5 2b a5 9d 48 19 71 |UO.:....~.+..H.q|
+| 56 15 b9 89 |V... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4448 found 0x342dd40
+
+dissect_ssl enter frame #192 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2d 7e 64 d1 d4 bb b7 06 06 ab 93 21 37 b1 58 fd |-~d........!7.X.|
+| 98 fe 27 e2 6a 7c b3 6a d7 be be 21 6e 6a 8b 98 |..'.j|.j...!nj..|
+| 91 c8 8d 1c 36 d5 84 4f b8 23 02 24 d8 cf 62 ad |....6..O.#.$..b.|
+Plaintext[48]:
+| c1 5d 52 33 77 47 a6 d0 8b 1c eb 6b 9f 6d 9f e6 |.]R3wG.....k.m..|
+| 01 00 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 |..a8....i...$..'|
+| 21 a9 28 c0 97 19 09 09 09 09 09 09 09 09 09 09 |!.(.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 61 38 ad f5 8a d6 69 da df 95 24 ff c7 27 21 a9 |a8....i...$..'!.|
+| 28 c0 97 19 |(... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #194 (first time)
+ conversation = 0x7facef998260, ssl_session = 0x7facc382b5b0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9c e0 8b 42 4a b9 05 46 ad ff 69 7f 0b c3 4c bf |...BJ..F..i...L.|
+| af be 30 e2 fc 0b 9e 2c 6c d0 9d 07 ea f4 fc 48 |..0....,l......H|
+| 9e e4 f8 34 c8 a8 bd bb fb c2 90 33 f2 78 83 78 |...4.......3.x.x|
+Plaintext[48]:
+| 0a 8b 34 b0 63 e9 d4 58 35 28 31 6b a8 69 1d 4c |..4.c..X5(1k.i.L|
+| 01 00 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a |..Y.8.d.........|
+| 59 35 7c 63 c2 dc 09 09 09 09 09 09 09 09 09 09 |Y5|c............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 59 a7 38 a2 64 06 f2 97 ee 05 eb 91 bf 8a 59 35 |Y.8.d.........Y5|
+| 7c 63 c2 dc ||c.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #199 (first time)
+ssl_session_init: initializing ptr 0x7facc382db70 size 688
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 35174 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4449
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #201 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0032 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 61 3c 50 08 4a d0 92 9a 68 1f df 81 6c f1 06 c2 |a<P.J...h...l...|
+| 43 d2 e4 fc b5 e8 59 e1 53 ab 4d be c5 35 54 35 |C.....Y.S.M..5T5|
+| 8d 1d 4e f9 bc a0 f1 e0 7b 1d 3c 0a d3 06 38 fa |..N.....{.<...8.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+PRF out[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+key expansion[104]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 5e 90 18 dd c0 fe dc 76 36 24 25 9b |.*Q.^......v6$%.|
+| fc 67 17 6a 8f 31 72 da 02 3b e7 51 e1 4e f6 c2 |.g.j.1r..;.Q.N..|
+| 11 f7 30 84 0e 70 45 44 ac 66 a0 8c b3 41 44 26 |..0..pED.f...AD&|
+| fa a2 45 07 af 74 fb 7d 6c a0 c8 88 b0 09 de 6c |..E..t.}l......l|
+| 0d ee 53 22 fe 91 78 f9 be e3 54 ac 03 24 0d 7b |..S"..x...T..$.{|
+| e3 ad bd 37 f8 4c e3 9b |...7.L.. |
+Client MAC key[20]:
+| d9 e2 55 c9 9c 52 79 39 36 8d a0 64 30 89 a6 a3 |..U..Ry96..d0...|
+| 1b 2a 51 99 |.*Q. |
+Server MAC key[20]:
+| 5e 90 18 dd c0 fe dc 76 36 24 25 9b fc 67 17 6a |^......v6$%..g.j|
+| 8f 31 72 da |.1r. |
+Client Write key[16]:
+| 02 3b e7 51 e1 4e f6 c2 11 f7 30 84 0e 70 45 44 |.;.Q.N....0..pED|
+Server Write key[16]:
+| ac 66 a0 8c b3 41 44 26 fa a2 45 07 af 74 fb 7d |.f...AD&..E..t.}|
+Client Write IV[16]:
+| 6c a0 c8 88 b0 09 de 6c 0d ee 53 22 fe 91 78 f9 |l......l..S"..x.|
+Server Write IV[16]:
+| be e3 54 ac 03 24 0d 7b e3 ad bd 37 f8 4c e3 9b |..T..$.{...7.L..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #203 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc4782...
+looking for RSA pre-master0080b9b978bd5956049bf352b112da25a73a33242f9817c7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 74 a6 ef e0 bc d2 ba 17 49 cc b8 fe d7 c3 f2 |"t.......I......|
+| 01 4f 63 f5 29 9b d4 47 2e 9f db 9d 67 52 34 bf |.Oc.)..G....gR4.|
+| 22 f0 fc 88 02 6c b6 7e 23 6c 61 77 46 7a cc ef |"....l.~#lawFz..|
+| 60 aa fc 47 82 6c 7c 58 87 4b 5f d5 6a |`..G.l|X.K_.j |
+hash out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+PRF out[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+key expansion[104]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 |...R.....(..S:[.|
+| 53 dc a5 ba c0 49 44 a0 53 f2 f7 ad 6d 66 6e a7 |S....ID.S...mfn.|
+| bf ff bc da 68 02 3c f7 d2 d8 6a 60 a7 20 6d 49 |....h.<...j`. mI|
+| de 7f e5 ea ea 22 d6 03 d0 a8 3c aa ee b8 a3 c8 |....."....<.....|
+| fa 52 3d 5e ed 97 c1 30 40 5e be ed 08 fb 46 d7 |.R=^...0@^....F.|
+| 9c a5 39 a0 b8 8d 7a ee |..9...z. |
+Client MAC key[20]:
+| 15 e3 a8 07 f9 65 95 28 aa 76 23 dc 2f f2 29 46 |.....e.(.v#./.)F|
+| d5 01 ab 52 |...R |
+Server MAC key[20]:
+| b1 ad aa d7 ca 28 2e e6 53 3a 5b 83 53 dc a5 ba |.....(..S:[.S...|
+| c0 49 44 a0 |.ID. |
+Client Write key[16]:
+| 53 f2 f7 ad 6d 66 6e a7 bf ff bc da 68 02 3c f7 |S...mfn.....h.<.|
+Server Write key[16]:
+| d2 d8 6a 60 a7 20 6d 49 de 7f e5 ea ea 22 d6 03 |..j`. mI....."..|
+Client Write IV[16]:
+| d0 a8 3c aa ee b8 a3 c8 fa 52 3d 5e ed 97 c1 30 |..<......R=^...0|
+Server Write IV[16]:
+| 40 5e be ed 08 fb 46 d7 9c a5 39 a0 b8 8d 7a ee |@^....F...9...z.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1a aa 5b 13 c1 e5 c2 55 12 09 6b 60 5b 4a 84 c0 |..[....U..k`[J..|
+| 65 a6 5e 50 3b 45 44 17 49 82 1c ff 91 bd 57 43 |e.^P;ED.I.....WC|
+| 59 e1 34 5b 6c 39 d9 56 c4 07 a7 91 7a 05 0f ff |Y.4[l9.V....z...|
+| 49 b5 78 5d 4f d6 27 87 cb d7 2b 30 92 74 45 89 |I.x]O.'...+0.tE.|
+Plaintext[64]:
+| c9 72 a6 91 af 7b f6 9f 3c 98 45 ae bd 13 51 18 |.r...{..<.E...Q.|
+| 14 00 00 0c 13 88 0e 46 45 6b fe 15 52 62 b0 1c |.......FEk..Rb..|
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Q>V............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cd 6c 8a 83 cf ce 8e d4 e0 d4 bd 34 a0 20 f1 15 |.l.........4. ..|
+| fc 51 3e 56 |.Q>V |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #204 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c cb 3d c7 4b 41 55 a1 6c 88 db a7 f2 7b 12 d6 |..=.KAU.l....{..|
+| f0 76 38 7d ff 01 bd f8 30 b8 1b ba bb ea 91 b6 |.v8}....0.......|
+| 2b 5d c9 7e 3b a7 a4 06 fc f0 6b d9 d1 81 55 56 |+].~;.....k...UV|
+| fe 9a 56 f3 3f dc 01 61 1c 7f 69 a7 6f 9f ce 1a |..V.?..a..i.o...|
+Plaintext[64]:
+| d0 72 3d d9 78 4a 2e 8b 82 8e 64 2c 0a 71 8b 5c |.r=.xJ....d,.q.\|
+| 14 00 00 0c 7b f3 4d d3 23 a2 c1 bc 5f d5 4c 84 |....{.M.#..._.L.|
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.`..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 f4 af 88 4c 19 05 af d8 48 14 16 8f d5 2c 40 |1...L....H....,@|
+| c5 60 09 e3 |.`.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #205 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 95 c2 42 13 da cc 84 b5 31 bb cc 7a 2d 8c 3a c5 |..B.....1..z-.:.|
+| 76 da 0f 00 83 0b db 4e 1a 04 b1 27 fc 8c a1 f7 |v......N...'....|
+| 0a be 0e 78 40 18 8a bd 20 cb fe f6 ff d3 9b c2 |...x@... .......|
+| fc 91 7a d5 b3 35 51 02 b9 1a 82 32 80 91 2c d2 |..z..5Q....2..,.|
+| fb f7 a1 e9 32 d2 37 32 73 76 16 29 68 52 7c a9 |....2.72sv.)hR|.|
+| 7a 69 6f eb 7c fc 50 83 5b 5f b5 72 4b b5 69 29 |zio.|.P.[_.rK.i)|
+| f1 25 40 c2 ba b0 41 ef 53 de 28 83 d0 fa 6b f8 |.%@...A.S.(...k.|
+Plaintext[112]:
+| ce 37 c8 32 fa f8 2f 01 1c a4 d7 d2 53 c2 74 73 |.7.2../.....S.ts|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 34 39 0d 0a 0d 0a 72 a0 8f 78 7e a3 57 49 |4449....r..x~.WI|
+| 6b ca 69 7b 19 37 aa d9 ef 6c 18 40 03 03 03 03 |k.i{.7...l.@....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 42 10 d3 40 4f e3 b3 15 17 78 c0 5d 6c 43 17 20 |B..@O....x.]lC. |
+| 5f 43 42 1b |_CB. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 35174 found (nil)
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #206 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| f9 c6 ca af d9 57 23 46 a9 cb e8 f7 3d 3b 8f 42 |.....W#F....=;.B|
+| fd 80 9a f0 70 a7 d9 84 9b 04 f5 e3 01 58 d7 88 |....p........X..|
+| 96 50 80 23 a7 7d 9c 7d 14 c9 19 e5 86 be ad b8 |.P.#.}.}........|
+| 86 65 11 e5 79 e2 f4 60 1f b7 fa bd 8f 4e 72 46 |.e..y..`.....NrF|
+| e8 b7 66 e5 09 54 fa 10 ae 96 61 4b 5c b4 3c e3 |..f..T....aK\.<.|
+| b9 35 a4 ef a6 ef c5 0c 81 ad 4b 5b bb 96 6c 0d |.5........K[..l.|
+| 2a 95 67 3c 7b 31 b8 81 e7 06 fc aa 7c 3d 6c 75 |*.g<{1......|=lu|
+| 3c 06 fb ec d6 57 5c 4d 55 14 8e 7e ab db de 54 |<....W\MU..~...T|
+| 7a 5b 60 cd dd b7 35 94 77 b4 ad 99 8b cd 34 97 |z[`...5.w.....4.|
+| c0 bb a9 7a 0d 6f 53 ce 76 8f e8 51 8a 8c dc f8 |...z.oS.v..Q....|
+| 5a b4 86 58 63 0f 91 5e c5 b3 d0 09 6a ca 6a f2 |Z..Xc..^....j.j.|
+| c9 b5 20 83 90 17 d2 7e 88 47 ba 95 89 ec dd 4a |.. ....~.G.....J|
+| d1 c4 cd 4f 22 40 cb 9d 6e 22 59 c6 66 dd 3f 48 |...O"@..n"Y.f.?H|
+| fa cd 37 c9 0a bd 29 8f 9a 70 b2 2a 2a 5d 36 24 |..7...)..p.**]6$|
+| 53 da db 7c 51 1c 93 67 cf a4 b2 db 3e 94 bc f5 |S..|Q..g....>...|
+| 88 be 16 d1 09 da ed 29 a6 ac 5b e5 b8 08 24 32 |.......)..[...$2|
+| 85 58 ae 47 c6 8c 77 e6 28 3a f2 49 00 d1 26 1e |.X.G..w.(:.I..&.|
+| 3e 1d fb 01 d1 cf ac 95 97 04 59 10 91 fb 47 1a |>.........Y...G.|
+| 91 11 fd 85 8d 79 14 56 35 16 66 ad 91 50 c8 3a |.....y.V5.f..P.:|
+| 5e 6c f4 f2 02 6c de a2 d6 cf 48 b3 c3 8f 1b c8 |^l...l....H.....|
+| 49 21 4c 5d 6c 49 49 43 29 88 0c ef 94 a8 d7 60 |I!L]lIIC)......`|
+| cf 72 be 34 54 cb b6 9e f2 c3 e6 d3 56 fc ab 4a |.r.4T.......V..J|
+| 5a f3 46 1d c4 98 ad 96 e4 bf 74 33 6b 74 a5 2e |Z.F.......t3kt..|
+| 28 d9 6e 6e b1 c1 7f e3 a1 d7 24 9c 0c 75 a7 fc |(.nn......$..u..|
+| 9c 74 64 3d fc 29 55 85 1b 6d fc ce df f3 98 44 |.td=.)U..m.....D|
+Plaintext[400]:
+| 8c 98 a2 4f 4b 5e c6 7b da 49 3c ff 53 de d6 70 |...OK^.{.I<.S..p|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 32 20 2d 20 44 48 45 2d 44 |x00,0x32 - DHE-D|
+| 53 53 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SS-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e be 07 e7 8d |nl'</script>....|
+| d4 2c d0 de 99 91 8d 2d a9 fe df a6 6b 27 96 3e |.,.....-....k'.>|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 79 57 0f 53 9a 8b 11 3b 7d fe 4c 8a 99 10 4f e4 |yW.S...;}.L...O.|
+| f8 1c 52 00 |..R. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4449 found 0x342ddd0
+
+dissect_ssl enter frame #207 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| cc 91 6e 69 2b ad f6 5d 0f 4c 48 28 a3 cb 08 c4 |..ni+..].LH(....|
+| 96 35 79 19 88 e9 4a f8 85 ef f6 73 b9 ff b7 41 |.5y...J....s...A|
+| 1c 8f 19 66 77 97 2b 8f 51 44 1b de ce ee 0c e3 |...fw.+.QD......|
+Plaintext[48]:
+| 72 0d d0 89 07 ec 22 1c c3 7a f4 20 15 8c 15 20 |r....."..z. ... |
+| 01 00 d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 |......l.<..q..Us|
+| 2a 4c 83 f1 9f 36 09 09 09 09 09 09 09 09 09 09 |*L...6..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d8 e9 d6 ac 6c e3 3c 87 ad 71 f2 04 55 73 2a 4c |....l.<..q..Us*L|
+| 83 f1 9f 36 |...6 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #209 (first time)
+ conversation = 0x7facef998508, ssl_session = 0x7facc382db70
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 90 aa ba 12 d1 e9 9a 9d aa 5a cd 26 66 dc ac 01 |.........Z.&f...|
+| 39 9f a1 98 a5 ec 81 97 7d 87 5a 9e 8e 58 c1 4d |9.......}.Z..X.M|
+| 21 80 07 64 7d 28 ac d2 f5 c9 51 98 2b b3 36 fb |!..d}(....Q.+.6.|
+Plaintext[48]:
+| 4a 36 7b 03 9d a9 ed 83 0e 67 07 9f e4 8b 7c ae |J6{......g....|.|
+| 01 00 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d |..S.g.......6E..|
+| 59 f6 a7 97 a5 d5 09 09 09 09 09 09 09 09 09 09 |Y...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 0b 67 f4 d8 ad f9 9b c9 90 36 45 a2 8d 59 f6 |S.g.......6E..Y.|
+| a7 97 a5 d5 |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #214 (first time)
+ssl_session_init: initializing ptr 0x7facc3830070 size 688
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 53394 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4450
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #216 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0033 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 5e 31 7b 8e 79 15 59 4b b1 fb e9 cb 20 92 4b 99 |^1{.y.YK.... .K.|
+| aa 7e ac c6 c6 43 15 2f da 4c 82 5c 0b 1e ad f3 |.~...C./.L.\....|
+| 9f e4 a2 83 c1 9c d9 f1 c7 c8 2e 6e c1 11 6f 1f |...........n..o.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+PRF out[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+key expansion[104]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd 95 7c f3 a1 7a aa e2 18 7c 14 5d eb |..^..|..z...|.].|
+| 44 de 1a 0e 8a 57 0f 31 11 18 c5 bf 7e 5f bb 80 |D....W.1....~_..|
+| 77 75 fd 33 6b 6e 72 b1 07 70 86 4b b1 1b 9b ae |wu.3knr..p.K....|
+| 7b da 46 f1 ee c2 e8 8f 40 64 89 a4 db 02 a5 98 |{.F.....@d......|
+| ec 83 72 a5 bb 31 a1 f2 93 d5 7f 76 99 ec f0 49 |..r..1.....v...I|
+| 4f 34 55 ac 31 de 9b 4e |O4U.1..N |
+Client MAC key[20]:
+| 20 b9 33 62 84 c4 81 bc cb fe d3 64 6b 4a 32 55 | .3b.......dkJ2U|
+| 12 8d 5e cd |..^. |
+Server MAC key[20]:
+| 95 7c f3 a1 7a aa e2 18 7c 14 5d eb 44 de 1a 0e |.|..z...|.].D...|
+| 8a 57 0f 31 |.W.1 |
+Client Write key[16]:
+| 11 18 c5 bf 7e 5f bb 80 77 75 fd 33 6b 6e 72 b1 |....~_..wu.3knr.|
+Server Write key[16]:
+| 07 70 86 4b b1 1b 9b ae 7b da 46 f1 ee c2 e8 8f |.p.K....{.F.....|
+Client Write IV[16]:
+| 40 64 89 a4 db 02 a5 98 ec 83 72 a5 bb 31 a1 f2 |@d........r..1..|
+Server Write IV[16]:
+| 93 d5 7f 76 99 ec f0 49 4f 34 55 ac 31 de 9b 4e |...v...IO4U.1..N|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #218 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91ae...
+looking for RSA pre-master008098036d78af04b0df0adf81fd3d92912cfb41a1fd72f7...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 1d 36 cb 96 d5 6b 2b 19 e2 9b 73 23 2d bd ea |".6...k+...s#-..|
+| 5d b3 3f 1c d2 b6 36 f6 df 51 2b 46 cd 52 34 bf |].?...6..Q+F.R4.|
+| 22 7d 0c fc d5 2d e6 89 a6 94 a4 69 22 8b 09 06 |"}...-.....i"...|
+| 68 e9 4f 91 ae ab 3a db 64 a0 d9 c6 92 |h.O...:.d.... |
+hash out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+PRF out[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+key expansion[104]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a |..0...u6....s...|
+| 28 58 15 6a c9 8d a4 90 b2 d6 70 be b2 30 1a c6 |(X.j......p..0..|
+| 4e d8 15 e0 d6 67 b7 8c 4d 85 e0 53 35 84 95 4e |N....g..M..S5..N|
+| 73 10 4d 3f 4a fc 2e ae c5 ae 50 0f f8 b1 f9 10 |s.M?J.....P.....|
+| cc cd 68 1a 7f e7 09 5a e0 00 51 bf 15 2b 12 bf |..h....Z..Q..+..|
+| f4 d3 a8 8e ab 53 46 db |.....SF. |
+Client MAC key[20]:
+| 73 ec 98 7c 79 9d a6 23 e6 42 10 be cb 1f b3 82 |s..|y..#.B......|
+| 8e 88 30 09 |..0. |
+Server MAC key[20]:
+| ae e3 75 36 0e 9b a6 f8 73 b0 e5 8a 28 58 15 6a |..u6....s...(X.j|
+| c9 8d a4 90 |.... |
+Client Write key[16]:
+| b2 d6 70 be b2 30 1a c6 4e d8 15 e0 d6 67 b7 8c |..p..0..N....g..|
+Server Write key[16]:
+| 4d 85 e0 53 35 84 95 4e 73 10 4d 3f 4a fc 2e ae |M..S5..Ns.M?J...|
+Client Write IV[16]:
+| c5 ae 50 0f f8 b1 f9 10 cc cd 68 1a 7f e7 09 5a |..P.......h....Z|
+Server Write IV[16]:
+| e0 00 51 bf 15 2b 12 bf f4 d3 a8 8e ab 53 46 db |..Q..+.......SF.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| da 1e 53 71 13 06 e0 4d 50 f4 f5 1e 8f 8b 4f 61 |..Sq...MP.....Oa|
+| a3 c6 75 18 d0 87 99 db 1a 5f 08 a9 b6 e9 f6 43 |..u......_.....C|
+| d9 d4 ef f2 73 f9 06 10 90 2c 8a a1 fe b9 48 b1 |....s....,....H.|
+| 36 48 2d 85 db b2 03 6a 22 30 bd d6 56 24 ea f5 |6H-....j"0..V$..|
+Plaintext[64]:
+| 34 6c 1c 72 2e c6 f9 f4 7b d1 c7 4c ce ac 42 0d |4l.r....{..L..B.|
+| 14 00 00 0c 62 68 8e 07 e3 e9 87 c4 64 4c ae 96 |....bh......dL..|
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..P?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 1c e2 21 5f fc c0 f8 b9 e8 7b 8e 10 9b cc ee |N..!_.....{.....|
+| 01 e1 50 3f |..P? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #219 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| de 04 09 48 bb 04 88 66 86 4f 28 a4 c4 98 58 02 |...H...f.O(...X.|
+| 3d 86 95 4a 9c a3 45 1e eb c4 27 9d 85 9a d6 b0 |=..J..E...'.....|
+| 4e cf c3 04 7d c0 1d 1a a1 0d e2 9f 72 a6 fa bb |N...}.......r...|
+| fe 60 f0 63 53 11 d6 bb a7 5d b4 be d7 dd ae 10 |.`.cS....]......|
+Plaintext[64]:
+| 60 fc 5d e4 11 09 ef 6f 85 b6 6e cd 0c a9 70 db |`.]....o..n...p.|
+| 14 00 00 0c a3 db ba fd 9c b7 bc e4 1d c6 6b ac |..............k.|
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.m.v............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 63 80 67 ce 10 1f dd 03 64 3d 43 a4 92 06 31 9c |c.g.....d=C...1.|
+| c6 6d 9d 76 |.m.v |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #220 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| f6 fe b7 9f c5 71 d6 09 31 21 97 31 71 2c ea 1e |.....q..1!.1q,..|
+| 46 d6 3b 94 19 f7 62 c3 5d 89 ee 1e aa e5 c8 03 |F.;...b.].......|
+| 3d 14 f5 36 4b 67 ef 79 fc 5b b5 e1 c2 0d eb bf |=..6Kg.y.[......|
+| 81 b3 9c 38 bb 8f af 7c 1c a2 06 de 1e 33 47 9a |...8...|.....3G.|
+| 3d ce d8 f7 ea f1 ff dc 88 76 b0 90 0c 46 8d bc |=........v...F..|
+| 7e c3 a1 5f 7c 0a 39 1d b2 07 ec 63 aa 66 d8 59 |~.._|.9....c.f.Y|
+| bf fb 7f 05 77 51 19 59 2d 4b aa 53 93 dd f6 73 |....wQ.Y-K.S...s|
+Plaintext[112]:
+| da bc 75 e8 e2 36 3a 4a 75 2d 01 cf ba 6a 95 58 |..u..6:Ju-...j.X|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 31 32 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s128-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 30 0d 0a 0d 0a 77 96 c7 8d e2 d2 15 e5 |4450....w.......|
+| 2d 77 c1 73 5e b2 37 5c d6 98 c4 28 03 03 03 03 |-w.s^.7\...(....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8b 17 28 9f f4 2e cf 5e f1 f4 29 db e2 ea b8 33 |..(....^..)....3|
+| fa d1 e7 58 |...X |
+ssl_decrypt_record: mac failed
+association_find: TCP port 53394 found (nil)
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #221 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 85 90 11 f6 15 d2 7c 8b 27 50 90 40 d2 e9 4b 86 |......|.'P.@..K.|
+| f8 40 92 7b e3 cc fb b5 e6 75 61 61 fb a4 1f a0 |.@.{.....uaa....|
+| 44 8a be c2 f5 10 41 8b 53 81 8c 69 01 13 14 b5 |D.....A.S..i....|
+| d8 eb 77 35 e1 5c 9f 07 11 af 60 6e b3 55 55 e6 |..w5.\....`n.UU.|
+| 4d e4 6e ba 2c a9 ee 82 29 11 7c 94 94 e6 00 da |M.n.,...).|.....|
+| 4d 31 7e f8 1e 75 78 8d c4 dd 2b 39 eb 87 0b 6a |M1~..ux...+9...j|
+| 76 a1 5d aa 5f 30 b9 ef a7 61 95 74 f9 2c a0 0f |v.]._0...a.t.,..|
+| f3 ca b7 b1 55 6b d5 7d 4b 9d 15 48 c7 03 92 c8 |....Uk.}K..H....|
+| 2a 47 a4 fa c5 90 2a 19 df d4 e8 1b 21 6f 4f f5 |*G....*.....!oO.|
+| fc 75 01 57 94 d6 24 ae ba d2 56 99 16 ef f2 43 |.u.W..$...V....C|
+| ad c6 c2 fe ad 7b cf b2 30 1d ab 4c 1e 7b 01 d0 |.....{..0..L.{..|
+| f7 d7 d4 dd 0d 9d 3b a5 77 43 b3 f2 92 41 0f bc |......;.wC...A..|
+| 5c be c8 55 ee 53 2a cb 79 12 de b2 8b 95 9e f3 |\..U.S*.y.......|
+| cd c0 f4 1a a4 ad be 94 30 00 c0 fd 0f 34 c5 a8 |........0....4..|
+| 36 ea b8 f2 33 af 2e 5e 1e c4 45 30 59 22 db a3 |6...3..^..E0Y"..|
+| 75 da 27 c9 c1 6e 99 73 83 db 49 00 44 9e 81 7a |u.'..n.s..I.D..z|
+| b2 b4 55 6d 4d ba d6 08 c2 61 41 f4 76 ab c2 dd |..UmM....aA.v...|
+| 2a 32 a4 49 82 12 f3 43 eb 94 22 56 2a 12 78 a1 |*2.I...C.."V*.x.|
+| 38 ab fb c8 fb 7c 9d f6 15 62 e2 98 d8 e9 14 0d |8....|...b......|
+| ab 0a d6 dd db 7f cc 92 81 ab fb 36 3d 32 64 a5 |...........6=2d.|
+| a0 d4 99 4f c2 d9 5e 2a 69 80 ab 9f 3b 2c 69 2f |...O..^*i...;,i/|
+| eb 9b fc dd a4 b1 51 eb f8 cd fd 82 2d 12 cf 3f |......Q.....-..?|
+| db c5 ec af 29 2f 89 6e 84 1b f3 81 7e b5 42 0c |....)/.n....~.B.|
+| 28 d4 48 8a 56 ad 0a cb 53 1c 11 f7 dd 17 f5 33 |(.H.V...S......3|
+| ca 61 bb 25 e1 17 d4 54 be 6a 35 9d 06 61 3e c1 |.a.%...T.j5..a>.|
+Plaintext[400]:
+| 0d cd 43 22 4e ee 0e 02 2d 1a 62 80 89 7a 97 9b |..C"N...-.b..z..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 33 20 2d 20 44 48 45 2d 52 |x00,0x33 - DHE-R|
+| 53 41 2d 41 45 53 31 32 38 2d 53 48 41 20 20 20 |SA-AES128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 31 32 38 29 20 20 4d 61 63 3d 53 |=AES(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 9a 78 5d db |nl'</script>.x].|
+| f5 ae 76 de ee 26 9b b1 fb df b3 42 94 8f 67 67 |..v..&.....B..gg|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 41 56 7d 9e 88 34 95 b0 3d 51 2b ad 81 89 3b |.AV}..4..=Q+...;|
+| 6f 02 89 b2 |o... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4450 found 0x342de60
+
+dissect_ssl enter frame #222 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 56 07 e5 3d a8 e5 e2 b7 82 32 98 51 b0 cd db 92 |V..=.....2.Q....|
+| 2e 71 94 4f 2c 50 48 f5 7c 00 e3 d6 53 ac ce 61 |.q.O,PH.|...S..a|
+| 32 c9 92 6a 9f 88 8e 81 0a fe 83 86 70 9b 87 4f |2..j........p..O|
+Plaintext[48]:
+| 6d fa 5a c7 06 29 98 f9 67 3a 23 41 64 47 1a b1 |m.Z..)..g:#AdG..|
+| 01 00 e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a |........3..$[49:|
+| 9e de e2 14 20 24 09 09 09 09 09 09 09 09 09 09 |.... $..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e1 1d 91 04 8d c6 33 e0 b0 24 5b 34 39 3a 9e de |......3..$[49:..|
+| e2 14 20 24 |.. $ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #224 (first time)
+ conversation = 0x7facef9987b0, ssl_session = 0x7facc3830070
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 67 87 bf 08 17 6d a5 3e 16 71 61 9c ca bb 8c 3e |g....m.>.qa....>|
+| e7 99 6f c3 8d 4b 94 e7 db 4d e8 d0 17 c8 ce fe |..o..K...M......|
+| 00 aa ed e8 69 4a 6c ff a6 1e 58 e6 86 04 27 33 |....iJl...X...'3|
+Plaintext[48]:
+| c6 1e 1e 46 38 d7 d1 db 27 a5 9b bf 8d a9 61 08 |...F8...'.....a.|
+| 01 00 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 |..3...V\......q.|
+| 18 63 43 5f 7c 01 09 09 09 09 09 09 09 09 09 09 |.cC_|...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 cc ca a3 56 5c 16 c8 a5 bc ed 01 71 03 18 63 |3...V\......q..c|
+| 43 5f 7c 01 |C_|. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #229 (first time)
+ssl_session_init: initializing ptr 0x7facc3832570 size 688
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45991 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4451
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #231 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 63 f4 d7 a0 ff 85 99 42 04 ea ca 66 0b 37 80 c6 |c......B...f.7..|
+| db 35 98 04 22 13 99 7c c2 a8 8a d9 17 83 19 46 |.5.."..|.......F|
+| 47 6c 12 01 69 e7 d8 16 7f e8 32 b6 e0 96 79 03 |Gl..i.....2...y.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+PRF out[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+key expansion[136]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd |..<.+x....v.e...|
+| fe 19 46 0c ef 8b e8 ad 7c 4f 97 74 31 57 f5 57 |..F.....|O.t1W.W|
+| 56 47 bc ef 4c c7 33 8e 92 f0 b6 6a 3b c7 ea 55 |VG..L.3....j;..U|
+| a8 aa 22 d0 26 cf 0c 08 01 13 48 92 c8 21 0a eb |..".&.....H..!..|
+| f9 8e 71 e5 1e 7d 6f 45 07 69 f9 2e 7e 6e 07 a4 |..q..}oE.i..~n..|
+| f7 64 2e 37 7c 5f b3 c8 ff 79 6e c4 8c 8b 77 88 |.d.7|_...yn...w.|
+| af 92 1c 13 83 9c 43 75 3a ca a7 e2 49 a7 0b bb |......Cu:...I...|
+| 52 f0 f8 09 aa 19 a5 43 |R......C |
+Client MAC key[20]:
+| 80 6f 5f 48 fb 67 16 f3 c9 12 64 ee 65 7e 77 84 |.o_H.g....d.e~w.|
+| 04 1a 3c ec |..<. |
+Server MAC key[20]:
+| 2b 78 c7 ec ee ea 76 f8 65 8e 0f fd fe 19 46 0c |+x....v.e.....F.|
+| ef 8b e8 ad |.... |
+Client Write key[32]:
+| 7c 4f 97 74 31 57 f5 57 56 47 bc ef 4c c7 33 8e ||O.t1W.WVG..L.3.|
+| 92 f0 b6 6a 3b c7 ea 55 a8 aa 22 d0 26 cf 0c 08 |...j;..U..".&...|
+Server Write key[32]:
+| 01 13 48 92 c8 21 0a eb f9 8e 71 e5 1e 7d 6f 45 |..H..!....q..}oE|
+| 07 69 f9 2e 7e 6e 07 a4 f7 64 2e 37 7c 5f b3 c8 |.i..~n...d.7|_..|
+Client Write IV[16]:
+| ff 79 6e c4 8c 8b 77 88 af 92 1c 13 83 9c 43 75 |.yn...w.......Cu|
+Server Write IV[16]:
+| 3a ca a7 e2 49 a7 0b bb 52 f0 f8 09 aa 19 a5 43 |:...I...R......C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #233 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a09...
+looking for RSA pre-master7c97fd12116f5cd9318ea3c2fd49a66dedcd1c3dd6580709...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 a1 3b b3 4c e2 97 d8 58 b8 13 bf b7 04 0c 2b |".;.L...X......+|
+| 8f cc 7b 08 f4 4e 83 58 2b 01 61 ee 5b 52 34 bf |..{..N.X+.a.[R4.|
+| 22 d6 d5 c5 a6 3c 2c de 9b 46 13 3f bd 92 25 2a |"....<,..F.?..%*|
+| 89 89 8b 8a 09 7a bd 69 bd 4b 0d 52 c3 |.....z.i.K.R. |
+hash out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+PRF out[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+key expansion[136]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c |.-.69..#(..k.V.\|
+| 8f 11 5c bb 27 8a 75 ae e5 21 ca ce 1b 2f 90 38 |..\.'.u..!.../.8|
+| 07 16 01 63 3c 91 ab 4a c4 82 b4 46 82 8b cc e2 |...c<..J...F....|
+| 53 21 62 af d0 8f aa fe 36 ba 16 c9 7b e9 2a b7 |S!b.....6...{.*.|
+| b7 80 d1 e2 1d 93 5f 44 79 a9 9e 3e 68 5c 89 3e |......_Dy..>h\.>|
+| cc 50 32 89 15 d4 99 26 08 c5 c8 26 75 f7 2a ed |.P2....&...&u.*.|
+| 24 ba 5f 03 57 b4 69 ba 0f 9d 74 ea d4 46 bb 51 |$._.W.i...t..F.Q|
+| 6a b3 10 38 53 5b df 4d |j..8S[.M |
+Client MAC key[20]:
+| 76 7c a1 87 18 28 64 7b 20 6e df ca 3b b2 5f 2b |v|...(d{ n..;._+|
+| 00 2d f7 36 |.-.6 |
+Server MAC key[20]:
+| 39 a4 b4 23 28 89 0c 6b 7f 56 a1 5c 8f 11 5c bb |9..#(..k.V.\..\.|
+| 27 8a 75 ae |'.u. |
+Client Write key[32]:
+| e5 21 ca ce 1b 2f 90 38 07 16 01 63 3c 91 ab 4a |.!.../.8...c<..J|
+| c4 82 b4 46 82 8b cc e2 53 21 62 af d0 8f aa fe |...F....S!b.....|
+Server Write key[32]:
+| 36 ba 16 c9 7b e9 2a b7 b7 80 d1 e2 1d 93 5f 44 |6...{.*......._D|
+| 79 a9 9e 3e 68 5c 89 3e cc 50 32 89 15 d4 99 26 |y..>h\.>.P2....&|
+Client Write IV[16]:
+| 08 c5 c8 26 75 f7 2a ed 24 ba 5f 03 57 b4 69 ba |...&u.*.$._.W.i.|
+Server Write IV[16]:
+| 0f 9d 74 ea d4 46 bb 51 6a b3 10 38 53 5b df 4d |..t..F.Qj..8S[.M|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 8c 5f 0e c2 4f 0d dc 70 fa 81 64 3a 7f df 6f 8a |._..O..p..d:..o.|
+| 65 73 62 2a 29 20 d4 c0 f1 da c9 6f 5a 2a 28 4e |esb*) .....oZ*(N|
+| 73 01 d3 3c 23 a0 8d ce ac df 8a 15 6b 27 40 ff |s..<#.......k'@.|
+| fe 10 b0 d9 e2 d1 87 33 8c 11 84 4b 4b d2 5e a1 |.......3...KK.^.|
+Plaintext[64]:
+| a3 e6 4c 96 5b 0a db 17 31 13 95 cc f2 bc b5 d5 |..L.[...1.......|
+| 14 00 00 0c a8 bd 4b 1c 45 58 96 01 31 fc b9 72 |......K.EX..1..r|
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.Y.5............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 90 7a ef 96 de 27 47 60 0a 9d 7b e9 1f e6 e5 15 |.z...'G`..{.....|
+| a7 59 ff 35 |.Y.5 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #234 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| dc 75 bf d7 50 2f 48 80 b7 82 c3 2c 9b 6f f2 e3 |.u..P/H....,.o..|
+| 24 9f d6 90 8c 41 02 9c 33 6f 04 3e 10 a2 f2 90 |$....A..3o.>....|
+| 2a 2b ed 75 f9 3e 2f 17 4f 4b 72 fc ee 11 ce cc |*+.u.>/.OKr.....|
+| 8c b0 3a 57 7e aa 79 2b 34 bc 75 2a ff 0c 3f 21 |..:W~.y+4.u*..?!|
+Plaintext[64]:
+| a9 ff 4a 61 99 33 93 3c ee 55 f2 51 a6 1e 53 9c |..Ja.3.<.U.Q..S.|
+| 14 00 00 0c ff 37 53 48 fe fb 5f ef 96 28 b4 62 |.....7SH.._..(.b|
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |b...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 68 ae d5 35 86 24 f0 eb 3e 27 cd 41 78 dd a0 77 |h..5.$..>'.Ax..w|
+| 62 e4 e4 d8 |b... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #235 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a9 ac 77 6a b9 49 cc 01 9e 99 52 80 0d c3 cd a9 |..wj.I....R.....|
+| d5 fe 73 b5 08 3b 39 9b 74 b2 db 0d 27 96 03 fa |..s..;9.t...'...|
+| e0 9e 07 37 fc 80 21 9b 6d bc d0 8a d2 8e d0 fb |...7..!.m.......|
+| c4 9a 33 3f be 1b 78 37 c9 fd cb 10 b7 85 26 12 |..3?..x7......&.|
+| 0a 72 19 84 27 7e fa 65 35 0c be 30 eb 96 eb c5 |.r..'~.e5..0....|
+| 8f 6e b2 72 84 89 d3 ef 1e 28 43 7d 7d f1 65 25 |.n.r.....(C}}.e%|
+| 44 fe 89 21 bb 84 11 ec 90 c8 43 d1 8b cf 49 3d |D..!......C...I=|
+Plaintext[112]:
+| 0d dc fe 87 9e 66 d3 86 a2 96 4e 92 2f e1 8f 4e |.....f....N./..N|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 61 65 73 32 35 36 2d 73 68 61 |Host: aes256-sha|
+| 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 |.local.al.lekens|
+| 74 65 79 6e 2e 6e 6c 3a 34 34 35 31 0d 0a 0d 0a |teyn.nl:4451....|
+| 55 00 17 d7 9e 89 64 21 f1 d5 16 e3 54 8a a1 72 |U.....d!....T..r|
+| 6d ea 4e 84 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m.N.............|
+ssl_decrypt_record found padding 11 final len 100
+checking mac (len 64, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 33 c7 49 3c 3f 3f 62 74 b0 97 4b 0c d1 15 9d 50 |3.I<??bt..K....P|
+| 9d f6 31 64 |..1d |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45991 found (nil)
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #236 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| e1 4b 6e 39 13 f9 49 04 59 41 e0 f6 2a 8d 8c 36 |.Kn9..I.YA..*..6|
+| f6 34 82 31 f5 67 82 d1 f0 bf e8 2d 9d e2 96 24 |.4.1.g.....-...$|
+| e7 86 60 83 94 e0 7a d9 36 91 36 88 52 3a b7 b4 |..`...z.6.6.R:..|
+| 3f 9a 3f ce 7c 5d 7d d8 ae 73 74 72 6b 3f a4 04 |?.?.|]}..strk?..|
+| 95 28 1c af 38 82 84 2c 64 2d cc dc 32 10 78 d9 |.(..8..,d-..2.x.|
+| 02 90 bc 6a ce 5b 70 8c 61 4b d1 57 31 c2 e2 47 |...j.[p.aK.W1..G|
+| 07 36 ff 73 0f f9 cb 68 74 2d 42 41 b3 ab b7 97 |.6.s...ht-BA....|
+| 8c fe 86 b2 60 96 11 94 08 44 fc 8f 03 87 7d 23 |....`....D....}#|
+| ad e9 e0 10 21 2b a6 f8 ac 63 b9 0d 0b bd 63 3a |....!+...c....c:|
+| 22 2b 75 7e 9b 69 ff 79 e6 aa 7c 5a 1c 81 db c4 |"+u~.i.y..|Z....|
+| bc 75 27 d1 53 cb 63 fe b4 2a c1 2c 82 d0 ee 4c |.u'.S.c..*.,...L|
+| 16 40 0f e0 88 c7 34 43 2b 8e 64 ae bd fa 5a 36 |.@....4C+.d...Z6|
+| 15 b6 3f 5a 8a 99 f6 68 eb a9 b5 3a 5d 79 cf a5 |..?Z...h...:]y..|
+| 93 11 09 69 69 0c cf ff cc 17 e7 3a 3e 88 34 9e |...ii......:>.4.|
+| a3 98 c3 d0 5d dc e6 5f 31 12 64 76 f8 66 1d da |....].._1.dv.f..|
+| d0 e5 61 fd ef fd b4 b2 0e ff 6f 19 12 ab 8c f5 |..a.......o.....|
+| ba 63 97 50 d7 f4 34 63 9b be aa 7e 18 9b 8b f7 |.c.P..4c...~....|
+| 49 5a 73 bf 30 e2 6f 78 fb c4 fb 32 60 dc 0a 48 |IZs.0.ox...2`..H|
+| bb a5 64 17 43 25 37 70 dc 95 21 64 6d f4 41 48 |..d.C%7p..!dm.AH|
+| 66 c7 0b 01 cd d6 8b 40 96 63 16 52 64 53 84 38 |f......@.c.RdS.8|
+| 94 15 bc 95 a9 c0 00 2f a3 22 89 bf d0 da 89 02 |......./."......|
+| 7d de a7 cc 6c 1e c9 e2 18 1e 9d 79 0b ce fe 8c |}...l......y....|
+| da c7 74 e9 8a 14 f4 3e 64 bf 70 e2 5b 53 d1 92 |..t....>d.p.[S..|
+| 4c e9 a0 2b a5 ce 4c a3 e7 72 be 63 08 6c 4f 58 |L..+..L..r.c.lOX|
+| 2e 94 3a 8a 7b 92 f7 46 aa 47 e4 28 16 12 27 68 |..:.{..F.G.(..'h|
+Plaintext[400]:
+| fe 07 3e 92 d3 80 72 af 82 76 8c 41 23 45 c9 c5 |..>...r..v.A#E..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 35 20 2d 20 41 45 53 32 35 |x00,0x35 - AES25|
+| 36 2d 53 48 41 20 20 20 20 20 20 20 20 20 20 20 |6-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e a2 05 fa 23 |nl'</script>...#|
+| a0 00 9c 53 8c 7e d3 dc 68 98 1b da 1b ec 58 43 |...S.~..h.....XC|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 f1 83 ba 77 40 95 49 8e 20 1e 75 be 14 e2 8c |....w@.I. .u....|
+| 6c 49 99 07 |lI.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4451 found 0x3424dc0
+
+dissect_ssl enter frame #237 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 26 87 b1 f9 e8 f1 33 20 91 34 02 00 78 4e 4a |x&.....3 .4..xNJ|
+| 91 3b 8b 17 91 de b0 cc fa c2 8c f5 1d 82 d1 a8 |.;..............|
+| d0 af b1 ba 6d a1 73 0f 51 f1 50 57 1c 94 6c 10 |....m.s.Q.PW..l.|
+Plaintext[48]:
+| 12 ec 43 b7 63 d8 9e 38 e7 c1 31 50 b9 22 a8 d3 |..C.c..8..1P."..|
+| 01 00 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f |..e...dV9@.%.k$/|
+| 1f b8 98 da 0f 76 09 09 09 09 09 09 09 09 09 09 |.....v..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 65 14 fa 9f 64 56 39 40 f0 25 81 6b 24 2f 1f b8 |e...dV9@.%.k$/..|
+| 98 da 0f 76 |...v |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #239 (first time)
+ conversation = 0x7facef998a58, ssl_session = 0x7facc3832570
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4b e0 4c ca 1b c6 2a 79 38 d1 eb a9 fb 86 98 7f |K.L...*y8.......|
+| e0 a4 2a 34 60 a5 ba 3f c6 89 b6 d7 bc 61 48 f5 |..*4`..?.....aH.|
+| 05 bb e3 ea 75 ed 5d c8 a4 a0 38 68 62 d4 54 97 |....u.]...8hb.T.|
+Plaintext[48]:
+| d4 72 5e 93 4c 53 89 73 09 a8 0b 04 14 8d 12 c6 |.r^.LS.s........|
+| 01 00 cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 |....v...........|
+| a5 bf 7f 45 a1 19 09 09 09 09 09 09 09 09 09 09 |...E............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cb dd 76 c6 cb d3 f8 d2 eb a3 d5 a6 ed 04 a5 bf |..v.............|
+| 7f 45 a1 19 |.E.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #244 (first time)
+ssl_session_init: initializing ptr 0x7facc3834af0 size 688
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44935 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4452
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #246 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0038 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9f 19 d2 38 de 2c 1c fa 56 ca 36 20 11 21 6e 09 |...8.,..V.6 .!n.|
+| be 33 a4 f0 08 e7 e5 86 a2 bf 27 ad f7 82 80 eb |.3........'.....|
+| c0 78 d9 82 bc 20 48 64 9f de 6e a2 ce a0 ee c5 |.x... Hd..n.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+PRF out[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+key expansion[136]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 |C...O...?.fzt.B8|
+| 14 49 c8 c0 63 b9 78 f6 55 5b 32 fb 0f ef b9 7f |.I..c.x.U[2.....|
+| 7c bd 10 ac 89 e5 16 75 27 f9 e6 ad 8a f4 07 f7 ||......u'.......|
+| 6c 2b e5 05 03 31 97 b6 41 72 d3 2e 3c df 70 8d |l+...1..Ar..<.p.|
+| 57 a6 03 68 34 99 3e d8 d2 14 58 b2 0a 86 40 30 |W..h4.>...X...@0|
+| 0a 11 4f ad 47 1c 23 33 7e a1 39 52 d0 fc 07 16 |..O.G.#3~.9R....|
+| 32 8a 8e 80 81 aa 11 15 a0 89 d6 b5 2a 6c 8c 91 |2...........*l..|
+| 27 4b be af 69 fb 6e 33 |'K..i.n3 |
+Client MAC key[20]:
+| 3c 7f 92 2f a1 f2 af 1e bc 3a 4d 91 ba f6 96 68 |<../.....:M....h|
+| 43 e3 db b2 |C... |
+Server MAC key[20]:
+| 4f 1c 9b af 3f f2 66 7a 74 a3 42 38 14 49 c8 c0 |O...?.fzt.B8.I..|
+| 63 b9 78 f6 |c.x. |
+Client Write key[32]:
+| 55 5b 32 fb 0f ef b9 7f 7c bd 10 ac 89 e5 16 75 |U[2.....|......u|
+| 27 f9 e6 ad 8a f4 07 f7 6c 2b e5 05 03 31 97 b6 |'.......l+...1..|
+Server Write key[32]:
+| 41 72 d3 2e 3c df 70 8d 57 a6 03 68 34 99 3e d8 |Ar..<.p.W..h4.>.|
+| d2 14 58 b2 0a 86 40 30 0a 11 4f ad 47 1c 23 33 |..X...@0..O.G.#3|
+Client Write IV[16]:
+| 7e a1 39 52 d0 fc 07 16 32 8a 8e 80 81 aa 11 15 |~.9R....2.......|
+Server Write IV[16]:
+| a0 89 d6 b5 2a 6c 8c 91 27 4b be af 69 fb 6e 33 |....*l..'K..i.n3|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #248 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a...
+looking for RSA pre-master0080a7f168aa7ed7d19030f70c424cdc8441875d8e56e5f3...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 22 6f 00 14 e4 aa 33 40 44 06 00 79 49 27 36 75 |"o....3@D..yI'6u|
+| 2e 18 96 0f 52 12 f0 b1 01 c7 79 30 b8 52 34 bf |....R.....y0.R4.|
+| 22 c3 b0 44 e2 4b fc 9a b0 7c 23 9f fa c9 4a 6d |"..D.K...|#...Jm|
+| 10 7f 59 e3 2a 07 59 b6 8c 90 e0 f1 f0 |..Y.*.Y...... |
+hash out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+PRF out[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+key expansion[136]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d 88 89 c5 ed a4 f0 72 06 ab 12 60 68 |.."]......r...`h|
+| 31 73 9a f6 b7 1c b6 2b 48 f1 89 95 81 bd ea d9 |1s.....+H.......|
+| 9b 62 1b f9 ea df c6 d3 7b 90 77 29 6f 4e 56 52 |.b......{.w)oNVR|
+| b7 98 d8 22 73 e7 34 40 1f 91 c7 68 07 5d 1c e5 |..."s.4@...h.]..|
+| ba 67 36 80 83 17 42 1d c8 aa d8 87 07 86 60 64 |.g6...B.......`d|
+| a7 ef de cc f0 96 02 06 4f 23 f4 a5 d5 d3 d9 32 |........O#.....2|
+| 40 78 25 1a 10 07 55 1f 4d 90 9a f2 c1 2f fd ad |@x%...U.M..../..|
+| 5c 6c 71 bc d6 2b 87 8f |\lq..+.. |
+Client MAC key[20]:
+| fa ca b8 cd 5c 79 51 2e 36 4d b5 a5 03 ee 3c 6a |....\yQ.6M....<j|
+| 01 ee 22 5d |.."] |
+Server MAC key[20]:
+| 88 89 c5 ed a4 f0 72 06 ab 12 60 68 31 73 9a f6 |......r...`h1s..|
+| b7 1c b6 2b |...+ |
+Client Write key[32]:
+| 48 f1 89 95 81 bd ea d9 9b 62 1b f9 ea df c6 d3 |H........b......|
+| 7b 90 77 29 6f 4e 56 52 b7 98 d8 22 73 e7 34 40 |{.w)oNVR..."s.4@|
+Server Write key[32]:
+| 1f 91 c7 68 07 5d 1c e5 ba 67 36 80 83 17 42 1d |...h.]...g6...B.|
+| c8 aa d8 87 07 86 60 64 a7 ef de cc f0 96 02 06 |......`d........|
+Client Write IV[16]:
+| 4f 23 f4 a5 d5 d3 d9 32 40 78 25 1a 10 07 55 1f |O#.....2@x%...U.|
+Server Write IV[16]:
+| 4d 90 9a f2 c1 2f fd ad 5c 6c 71 bc d6 2b 87 8f |M..../..\lq..+..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 75 ec a8 08 8d 09 8e 87 a8 98 7b 51 25 1b ae 82 |u.........{Q%...|
+| e2 a6 b2 5d f6 32 6b fe f8 ac 26 ac c4 56 31 11 |...].2k...&..V1.|
+| 39 84 98 44 2b d7 5d b6 fa 69 c1 d4 6b cb 3d c0 |9..D+.]..i..k.=.|
+| d8 6b 33 b8 44 82 ea 29 a3 c4 c1 97 5c 3f 29 9a |.k3.D..)....\?).|
+Plaintext[64]:
+| 7c 31 75 5d eb 2c ae f4 03 be 09 1e 27 1e 34 a1 ||1u].,......'.4.|
+| 14 00 00 0c 4c 70 79 30 7d 62 93 b9 aa a7 5f 06 |....Lpy0}b...._.|
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |9...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e d4 1c 57 83 4a 6d 82 1c 29 30 cc 8d 7b 32 0e |N..W.Jm..)0..{2.|
+| 39 a5 e0 81 |9... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #249 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 38 2e 86 e7 be b4 97 c9 14 35 55 8e 1a 55 5b 09 |8........5U..U[.|
+| 22 5d 71 76 41 ce 1e fe 5f 63 3d 29 75 b3 7b 4f |"]qvA..._c=)u.{O|
+| 23 90 a1 7a f2 19 20 db 1f 3b 6f c6 6b 8c f8 47 |#..z.. ..;o.k..G|
+| 71 29 3d 42 b4 f5 17 2e 49 c5 e8 5e e5 a9 62 2e |q)=B....I..^..b.|
+Plaintext[64]:
+| 3f 01 11 a1 3f 61 78 54 aa 7c b8 be 12 da fb 02 |?...?axT.|......|
+| 14 00 00 0c e4 9f 8d b2 d5 96 3c c5 43 84 29 fc |..........<.C.).|
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |n...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 01 ef 6e ca 80 60 7a cb 37 97 ca 54 95 a4 f3 6f |..n..`z.7..T...o|
+| 6e fd c9 e5 |n... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #250 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| a7 d1 79 03 e0 60 6c 8b 88 f0 09 db 2f 23 16 25 |..y..`l...../#.%|
+| e4 84 0d b2 8a 6a d3 e0 b6 aa be 5f 1c f4 b7 8c |.....j....._....|
+| ec e5 6a 55 39 4c fc 25 05 da e9 e4 d1 14 bf a2 |..jU9L.%........|
+| 0d f9 6e 1a a1 96 ea 3f 51 6f b9 74 ba b3 d3 2b |..n....?Qo.t...+|
+| a3 ff d5 73 53 b9 d9 14 a4 d5 13 23 56 17 3c d4 |...sS......#V.<.|
+| 88 e3 50 a6 e2 fd 32 36 2b e7 3a c1 09 b8 3b 4f |..P...26+.:...;O|
+| 72 8d 0f c7 f3 05 be 1f a6 4b f5 6f d5 b3 0d 9f |r........K.o....|
+Plaintext[112]:
+| f9 72 0c c3 30 cc 1a 85 4e ab 61 7c d0 1b 23 18 |.r..0...N.a|..#.|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 61 65 |Host: dhe-dss-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 32 0d 0a 0d 0a d7 a0 6a fb 98 3c ab 7d |4452......j..<.}|
+| 58 18 26 01 f1 a9 46 5f f5 22 9e 3a 03 03 03 03 |X.&...F_.".:....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3e f2 5c ad ee da 26 50 45 65 0a 80 cc 99 2f fd |>.\...&PEe..../.|
+| e3 76 ab 8f |.v.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44935 found (nil)
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #251 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 07 25 c2 b9 e3 c5 07 31 5d 7e 76 d2 35 df a7 27 |.%.....1]~v.5..'|
+| 79 f5 62 56 fa 8e 9b 7e 73 03 c1 b0 15 55 5e 39 |y.bV...~s....U^9|
+| 38 3b 16 78 a1 88 da fe 33 48 6e ac df 30 34 ce |8;.x....3Hn..04.|
+| 18 b2 c4 83 4a b0 e6 67 2e 20 2a d9 25 75 fb 17 |....J..g. *.%u..|
+| 85 ea 08 af 6f 3d ae cd e4 50 a2 e1 d5 0a 59 c3 |....o=...P....Y.|
+| c8 3d af e6 1d 70 eb 6f 41 ca 32 57 a6 53 f4 86 |.=...p.oA.2W.S..|
+| 4b 7f ae 77 55 cc 68 c2 cb 22 e0 4a 13 d8 e8 dc |K..wU.h..".J....|
+| d4 95 63 8c 69 19 91 94 48 da f7 65 3c ed b5 03 |..c.i...H..e<...|
+| 86 c6 fc e0 6c fb b0 70 85 9e e7 14 aa ed dc 49 |....l..p.......I|
+| 61 75 88 ff 72 a1 2c 6e 69 47 5d 92 2e 0a 9e 0a |au..r.,niG].....|
+| fb a1 da e5 d4 9c 36 a0 3b 8d 23 2c 12 68 a2 85 |......6.;.#,.h..|
+| 02 b5 99 26 9a 66 9b c0 01 1b 8b a6 e5 13 94 88 |...&.f..........|
+| 0a 75 fa 61 8d da e0 a9 41 47 a3 0e 2b 18 f2 2f |.u.a....AG..+../|
+| c8 93 2f 68 99 37 8d 72 bc 99 ab e9 df 80 55 ba |../h.7.r......U.|
+| 05 14 dd ba 41 b2 66 a5 8a 24 f5 99 2b f3 c9 8f |....A.f..$..+...|
+| 4b 45 d3 0c 55 2b 6e a3 93 7b 0a db 96 86 34 7f |KE..U+n..{....4.|
+| 37 bc 50 d8 15 34 47 61 9c 75 af a8 5b 5d ab 5b |7.P..4Ga.u..[].[|
+| 1e cb 9a 04 49 e6 3b 53 12 fa 21 25 7d b9 2f 68 |....I.;S..!%}./h|
+| da ae 3a e5 20 8b d6 49 47 ca c9 45 c4 3b 9f 9c |..:. ..IG..E.;..|
+| 43 c0 01 9f 8f 11 39 b1 5a 3c 89 2e de 09 4e 65 |C.....9.Z<....Ne|
+| ce aa d4 4b 4b 02 8a a5 3a 0d 68 20 8c 09 22 b6 |...KK...:.h ..".|
+| 92 67 d5 74 03 10 63 4d 15 6d a0 ed fa 5c 55 bc |.g.t..cM.m...\U.|
+| da ea 35 05 44 7e 28 36 1a 0c d7 8e 73 2c 25 de |..5.D~(6....s,%.|
+| ec 81 ff 06 5a 4a 82 de 08 5a 80 93 91 75 e0 fd |....ZJ...Z...u..|
+| c3 67 a5 ce 08 43 a4 db ce 1d 09 78 6f 87 a7 96 |.g...C.....xo...|
+Plaintext[400]:
+| 3e 38 79 cc e8 37 06 2d 17 6a 2d 3d b3 bf 24 46 |>8y..7.-.j-=..$F|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:14 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 38 20 2d 20 44 48 45 2d 44 |x00,0x38 - DHE-D|
+| 53 53 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SS-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 81 6e 9d ae |nl'</script>.n..|
+| 14 ca ec 62 1a b2 1a a6 a0 62 21 bc 50 63 81 16 |...b.....b!.Pc..|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 14 66 d1 03 82 dd 26 c5 2f 30 f1 f2 86 8e e5 82 |.f....&./0......|
+| 30 1e 81 e9 |0... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4452 found 0x3425580
+
+dissect_ssl enter frame #252 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| f6 4a 3f 4c 1d d6 d3 2c fe 8e 4f 8f 4c 31 52 5e |.J?L...,..O.L1R^|
+| 8a 53 bb 66 b4 2c 1b a2 f9 56 3c e5 68 8e 88 25 |.S.f.,...V<.h..%|
+| be 47 a4 bc f0 e4 99 61 67 03 50 f6 d5 8b 2c c1 |.G.....ag.P...,.|
+Plaintext[48]:
+| 08 4c cf cb 75 b3 56 cb 0f c5 f9 44 13 87 bd 8c |.L..u.V....D....|
+| 01 00 b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e |.....M...l.%....|
+| 85 f6 67 9a 38 75 09 09 09 09 09 09 09 09 09 09 |..g.8u..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b9 08 e0 4d d2 d9 b2 6c cf 25 a5 eb ed 2e 85 f6 |...M...l.%......|
+| 67 9a 38 75 |g.8u |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #254 (first time)
+ conversation = 0x7facef998d00, ssl_session = 0x7facc3834af0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a 35 0b d6 e7 5b 20 4c 59 dd 07 48 cb b1 49 6f |.5...[ LY..H..Io|
+| 54 bc fd 71 99 d8 f6 92 5b 7f 0f 1a b7 8d c3 4b |T..q....[......K|
+| bd d3 84 e0 95 dc 0d e2 3f 86 8d 69 f5 5a 82 59 |........?..i.Z.Y|
+Plaintext[48]:
+| 51 02 c2 5e ff 54 55 ff de 55 11 c8 1d 7c 9a 09 |Q..^.TU..U...|..|
+| 01 00 f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 |.....Y..u8.|<.KA|
+| e9 91 92 e7 fa 51 09 09 09 09 09 09 09 09 09 09 |.....Q..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f1 fa b9 59 f5 be 75 38 13 7c 3c 18 4b 41 e9 91 |...Y..u8.|<.KA..|
+| 92 e7 fa 51 |...Q |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #259 (first time)
+ssl_session_init: initializing ptr 0x7facc3837030 size 688
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 52817 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4453
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #261 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0039 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| a7 59 28 89 bf cd 53 b6 49 5a 4f ed b0 4c a6 13 |.Y(...S.IZO..L..|
+| 97 f1 f8 e9 31 8b c0 e8 86 87 2b 5c c8 1e 1d e4 |....1.....+\....|
+| 85 42 cf fa a5 59 23 cb 6e 3a 5a 68 76 df 69 97 |.B...Y#.n:Zhv.i.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+PRF out[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+key expansion[136]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 |.Y.......W...u.'|
+| 22 37 8a 74 37 cd 58 77 cd da 50 dd 9f c1 25 35 |"7.t7.Xw..P...%5|
+| ee c7 62 fd 60 b0 42 53 51 25 4d 1e f5 53 0b 9f |..b.`.BSQ%M..S..|
+| db f1 9c fd 5d 71 6d 82 22 8e 83 c8 70 0f 43 e9 |....]qm."...p.C.|
+| a2 85 08 25 82 52 93 72 07 6b 3c 79 1a 9e 77 79 |...%.R.r.k<y..wy|
+| f0 c2 6b 62 5e 01 bf 94 8d c0 ba a0 95 35 3c 4f |..kb^........5<O|
+| d6 96 33 87 ff 92 e0 78 1e 6c 14 47 c9 cc 10 17 |..3....x.l.G....|
+| af a9 91 59 0f d2 30 6e |...Y..0n |
+Client MAC key[20]:
+| f8 66 76 ec 4c 76 e5 82 2e 4e 5e 33 05 82 22 83 |.fv.Lv...N^3..".|
+| 02 59 c5 f6 |.Y.. |
+Server MAC key[20]:
+| 8a 8a 97 a8 ba 57 92 f6 c5 75 cb 27 22 37 8a 74 |.....W...u.'"7.t|
+| 37 cd 58 77 |7.Xw |
+Client Write key[32]:
+| cd da 50 dd 9f c1 25 35 ee c7 62 fd 60 b0 42 53 |..P...%5..b.`.BS|
+| 51 25 4d 1e f5 53 0b 9f db f1 9c fd 5d 71 6d 82 |Q%M..S......]qm.|
+Server Write key[32]:
+| 22 8e 83 c8 70 0f 43 e9 a2 85 08 25 82 52 93 72 |"...p.C....%.R.r|
+| 07 6b 3c 79 1a 9e 77 79 f0 c2 6b 62 5e 01 bf 94 |.k<y..wy..kb^...|
+Client Write IV[16]:
+| 8d c0 ba a0 95 35 3c 4f d6 96 33 87 ff 92 e0 78 |.....5<O..3....x|
+Server Write IV[16]:
+| 1e 6c 14 47 c9 cc 10 17 af a9 91 59 0f d2 30 6e |.l.G.......Y..0n|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #263 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67...
+looking for RSA pre-master0080a34aa68a1ab4c3cf96ca5afc9a068e82cadf846fb144...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 17 69 75 07 cb bb 39 67 cb 4f 6c 4d 3f a8 99 |#.iu...9g.OlM?..|
+| 98 84 b6 53 ce 71 83 8b 04 22 ee 96 c0 52 34 bf |...S.q..."...R4.|
+| 23 c7 ee fe 88 63 f2 03 a7 30 98 37 ea cd bf 2a |#....c...0.7...*|
+| 9a d5 d6 bb 67 b9 01 ad 09 6a f5 f7 2e |....g....j... |
+hash out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+PRF out[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+key expansion[136]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 |...!.nm...3[....|
+| 75 22 5a 3b 72 fc dd 11 d9 90 b0 18 52 4f 80 e0 |u"Z;r.......RO..|
+| f2 31 97 a7 cb ce 65 9f e5 32 7c 31 b4 a5 0f fb |.1....e..2|1....|
+| eb b1 3f 58 98 20 86 72 1f 9b ed ea 9e 28 4c 76 |..?X. .r.....(Lv|
+| 61 2c 96 75 57 c9 c8 3e 01 10 2f d9 7b 52 48 f2 |a,.uW..>../.{RH.|
+| 9c cf a2 75 eb c3 48 fe df c2 e0 65 cc d5 1b 7d |...u..H....e...}|
+| 41 90 f2 cc 91 c3 a2 19 ef cb eb c3 66 14 5f 48 |A...........f._H|
+| 27 84 d2 b3 94 79 87 ce |'....y.. |
+Client MAC key[20]:
+| c4 b3 e3 66 c0 59 d7 08 1a 97 92 54 0c ef 30 bb |...f.Y.....T..0.|
+| a0 1c ff 21 |...! |
+Server MAC key[20]:
+| 97 6e 6d 02 ea c1 33 5b e9 ec 9a b5 75 22 5a 3b |.nm...3[....u"Z;|
+| 72 fc dd 11 |r... |
+Client Write key[32]:
+| d9 90 b0 18 52 4f 80 e0 f2 31 97 a7 cb ce 65 9f |....RO...1....e.|
+| e5 32 7c 31 b4 a5 0f fb eb b1 3f 58 98 20 86 72 |.2|1......?X. .r|
+Server Write key[32]:
+| 1f 9b ed ea 9e 28 4c 76 61 2c 96 75 57 c9 c8 3e |.....(Lva,.uW..>|
+| 01 10 2f d9 7b 52 48 f2 9c cf a2 75 eb c3 48 fe |../.{RH....u..H.|
+Client Write IV[16]:
+| df c2 e0 65 cc d5 1b 7d 41 90 f2 cc 91 c3 a2 19 |...e...}A.......|
+Server Write IV[16]:
+| ef cb eb c3 66 14 5f 48 27 84 d2 b3 94 79 87 ce |....f._H'....y..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: AES256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f9 cd f8 0e 2a 35 1c 38 46 b8 97 ee d0 2d ad 13 |....*5.8F....-..|
+| 64 bf 9d db bc 38 b3 28 89 4d 91 61 37 9c 4d f1 |d....8.(.M.a7.M.|
+| 60 97 d3 e8 30 61 8d 4f 41 6e 25 ed 6f 7e 06 10 |`...0a.OAn%.o~..|
+| 82 25 58 bd 33 a9 83 0f ce ac 88 f7 fb d2 19 72 |.%X.3..........r|
+Plaintext[64]:
+| d8 db 31 5a 45 68 02 52 59 02 8d 8c 6b b4 e0 f5 |..1ZEh.RY...k...|
+| 14 00 00 0c d8 a7 bc e3 c6 f1 50 8b 6f 2c 9e f6 |..........P.o,..|
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |u...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 0b c4 0a b0 71 5e 2c e1 79 69 eb f8 24 38 08 |.....q^,.yi..$8.|
+| 75 e6 8c 93 |u... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #264 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 1c e7 46 55 44 95 2c e0 54 e3 9a 5f 49 d7 29 28 |..FUD.,.T.._I.)(|
+| f4 a9 a5 cd ee a9 1d 6f 00 a3 9e c5 fa 99 8d 85 |.......o........|
+| 73 3b e9 84 48 a3 85 d7 d6 61 4c be fe 6f 6e 35 |s;..H....aL..on5|
+| 34 30 b3 c9 b2 0c 4e 96 ca 1d ad a3 dd a9 21 dd |40....N.......!.|
+Plaintext[64]:
+| c2 a4 95 cb 42 16 52 56 6b ab 48 02 63 36 6a d9 |....B.RVk.H.c6j.|
+| 14 00 00 0c 9b ca bc 2d 37 c6 5e f6 7a 33 71 e8 |.......-7.^.z3q.|
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..Y?............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 00 89 44 f0 06 c4 b1 3e 6f f7 55 5f 26 2c 73 1e |..D....>o.U_&,s.|
+| af 01 59 3f |..Y? |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #265 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 1e ab cc b1 b6 4c d0 fb f9 84 f6 6d 1e 43 80 d7 |.....L.....m.C..|
+| c7 06 39 3e 38 de c6 38 9e 31 69 b6 1d e9 4e 2e |..9>8..8.1i...N.|
+| c1 7a 67 e1 19 7b 3f d8 92 21 f7 3c 30 85 c4 ff |.zg..{?..!.<0...|
+| 85 08 1a 5e 3d bf 8e 49 e3 b6 1f 6d f9 50 fe 99 |...^=..I...m.P..|
+| 9c b6 d4 c7 b6 81 2b 92 0f aa f6 b8 09 a8 03 0e |......+.........|
+| 7b 1a 02 9d 04 08 c0 10 2c 2a 0c 05 12 be 1c bb |{.......,*......|
+| c8 6c 83 7c 4a c6 7b ca 14 ee 7d 86 fe ea c0 f8 |.l.|J.{...}.....|
+Plaintext[112]:
+| a6 54 42 d0 c7 bf 33 a3 9c 3e dc 31 3d 40 bf ad |.TB...3..>.1=@..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 61 65 |Host: dhe-rsa-ae|
+| 73 32 35 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 |s256-sha.local.a|
+| 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a |l.lekensteyn.nl:|
+| 34 34 35 33 0d 0a 0d 0a 94 27 43 3c 34 7e 07 8b |4453.....'C<4~..|
+| a5 94 3d 0b ba f1 82 54 d5 0d 3a 21 03 03 03 03 |..=....T..:!....|
+ssl_decrypt_record found padding 3 final len 108
+checking mac (len 72, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 25 f9 9a f8 88 2f 31 15 24 07 80 a3 88 1b 23 b0 |%..../1.$.....#.|
+| 17 c4 76 f2 |..v. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 52817 found (nil)
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #266 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| cb 1e 48 31 e7 63 1e 7f 99 78 23 80 2e 9a c3 3d |..H1.c...x#....=|
+| 9a 74 54 80 bc 1e 6d e5 8e ce 3a 2e 28 6b 3c 27 |.tT...m...:.(k<'|
+| 09 6c 99 07 c8 f9 63 84 53 b7 cb 7d 64 3f 04 dc |.l....c.S..}d?..|
+| ef 09 a3 9f 52 c8 dd a3 03 50 d9 d9 93 fa 19 0a |....R....P......|
+| a7 02 15 6c 44 43 62 c6 73 6b 5c 18 c0 3d 1c ce |...lDCb.sk\..=..|
+| db 41 fa 80 2f 78 f4 3f 16 74 e4 0f 05 12 4c d3 |.A../x.?.t....L.|
+| 4f 18 12 12 70 14 83 13 e2 4d 45 bd fe 7b 8b 03 |O...p....ME..{..|
+| 00 d6 8c 28 9a ec e8 9e 3f 76 0a df 98 0e 02 88 |...(....?v......|
+| fc 12 df 72 5f b3 85 5b 46 90 9d 84 72 58 cf 0e |...r_..[F...rX..|
+| 6f 25 ff 40 16 eb 8d 6b 44 e1 d3 0b 55 83 a5 0f |o%.@...kD...U...|
+| 14 d0 bd 0e b4 a2 45 a2 a9 31 58 05 76 c8 8e 47 |......E..1X.v..G|
+| 71 6c b0 e6 87 7f 11 77 c8 fd 19 f7 9a c1 ef b7 |ql.....w........|
+| 2c f1 05 83 f0 85 d0 a7 91 10 b5 1f 0c 54 4a 90 |,............TJ.|
+| 5c 6e bb c6 2e a7 d4 7a d6 a2 ce 23 5d 65 ab c5 |\n.....z...#]e..|
+| c2 fd 82 b0 2b de d6 86 22 c8 47 04 cf 23 8f e2 |....+...".G..#..|
+| de c2 5c 42 91 38 7b 4f 92 83 ef a6 b7 f7 62 22 |..\B.8{O......b"|
+| 6d 5a 0c bc 69 fa be 94 bf da 04 a8 7d e8 ea 37 |mZ..i.......}..7|
+| ef 91 d9 3f 50 e9 0c 15 d9 86 9b 1f ca 23 f1 5d |...?P........#.]|
+| e8 b2 31 64 11 00 db 65 7e 6b 03 6b 5d db 86 bc |..1d...e~k.k]...|
+| 43 62 cb af c2 7b e7 cb 09 1f 2e 76 e2 c3 7f 9a |Cb...{.....v....|
+| 0b 6a 81 99 83 c5 90 8d 8b 44 b7 87 4c 48 f5 ba |.j.......D..LH..|
+| 27 8d e1 ee 51 f8 28 50 36 05 02 99 26 cb 5a 26 |'...Q.(P6...&.Z&|
+| ac 21 a5 cb 75 11 d8 10 cf ee 12 31 b8 fe 1b 74 |.!..u......1...t|
+| 85 ae 19 32 9e 31 af a8 6f be 2d e9 6b 78 90 e5 |...2.1..o.-.kx..|
+| 51 b6 5b dd fa e8 7a dc 45 c8 29 75 f3 10 74 17 |Q.[...z.E.)u..t.|
+Plaintext[400]:
+| 78 b9 b9 b5 43 4a a2 10 2b 58 5d b4 0d 45 73 ab |x...CJ..+X]..Es.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 33 39 20 2d 20 44 48 45 2d 52 |x00,0x39 - DHE-R|
+| 53 41 2d 41 45 53 32 35 36 2d 53 48 41 20 20 20 |SA-AES256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 41 45 53 28 32 35 36 29 20 20 4d 61 63 3d 53 |=AES(256) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e 84 88 3a 81 |nl'</script>..:.|
+| 34 a6 10 78 7a ae 78 fb 12 7e c3 79 18 c9 78 71 |4..xz.x..~.y..xq|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| a1 61 90 93 11 23 77 13 ea a4 e9 b0 1f a3 bc 51 |.a...#w........Q|
+| 78 a2 17 80 |x... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4453 found 0x3425530
+
+dissect_ssl enter frame #267 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 4e 95 cc 52 06 b4 4c 17 89 3a 8c 81 42 34 23 52 |N..R..L..:..B4#R|
+| 22 67 92 51 c5 fc be 40 0f a1 22 b0 d5 59 d2 c7 |"g.Q...@.."..Y..|
+| 4b 2b 16 d4 59 0a 38 9c 51 b8 6d 86 af a6 b9 22 |K+..Y.8.Q.m...."|
+Plaintext[48]:
+| 9e c3 0d 82 a9 67 6b 4d a5 4e 0c f5 40 9a 8f 12 |.....gkM.N..@...|
+| 01 00 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 |..7..d..Vc.p...I|
+| 99 87 66 a0 c6 d1 09 09 09 09 09 09 09 09 09 09 |..f.............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 a4 fd 64 2e 98 56 63 a5 70 e0 d7 0a 49 99 87 |7..d..Vc.p...I..|
+| 66 a0 c6 d1 |f... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #269 (first time)
+ conversation = 0x7facef998fa8, ssl_session = 0x7facc3837030
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2c a4 58 8b 8b 93 11 d3 3d 11 6b 35 42 be d7 52 |,.X.....=.k5B..R|
+| 33 27 b3 a3 3e de 83 f0 a8 e1 53 dc 9b c0 d4 71 |3'..>.....S....q|
+| 53 72 b8 fb 87 5d d1 7e 61 01 b3 41 c0 5d 56 3f |Sr...].~a..A.]V?|
+Plaintext[48]:
+| ff 5e e5 02 7a c0 2e 50 99 54 67 49 c2 35 6d 14 |.^..z..P.TgI.5m.|
+| 01 00 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b |..N..Q/#.R.."T.+|
+| 5b 9f 0b ac 53 8b 09 09 09 09 09 09 09 09 09 09 |[...S...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4e 8f 01 51 2f 23 ad 52 ab 16 22 54 bd 2b 5b 9f |N..Q/#.R.."T.+[.|
+| 0b ac 53 8b |..S. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #274 (first time)
+ssl_session_init: initializing ptr 0x7facc3839530 size 688
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 50333 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4457
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #276 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0041 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 20 b7 f1 51 ab 0a d5 94 9d 9b a4 38 49 52 ee 40 | ..Q.......8IR.@|
+| fd 5b 0f 36 23 71 b4 59 5e 13 d2 e2 d7 54 db c9 |.[.6#q.Y^....T..|
+| 45 c4 a9 de b3 ca 64 db 24 88 4c 9e 48 83 2b 9e |E.....d.$.L.H.+.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+PRF out[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+key expansion[104]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f |..J8..KU.X.:U-..|
+| 89 44 4a 98 db ad 27 69 62 d8 46 48 48 fa c3 98 |.DJ...'ib.FHH...|
+| 43 81 83 58 fb df 64 e2 a2 26 cc 21 7e 20 1b 04 |C..X..d..&.!~ ..|
+| 81 ad 69 c5 bf 1b 86 c5 89 0b 05 b8 1b f3 f7 2f |..i............/|
+| fa c6 98 1e 9c 4d 4c 68 1c 61 a2 49 5a b2 90 2f |.....MLh.a.IZ../|
+| fd 63 2a d8 4d 83 95 58 |.c*.M..X |
+Client MAC key[20]:
+| 7e 59 53 fc 10 a2 11 e2 b6 77 49 93 e7 47 00 52 |~YS......wI..G.R|
+| a8 ae 4a 38 |..J8 |
+Server MAC key[20]:
+| b5 95 4b 55 9f 58 b0 3a 55 2d bd 0f 89 44 4a 98 |..KU.X.:U-...DJ.|
+| db ad 27 69 |..'i |
+Client Write key[16]:
+| 62 d8 46 48 48 fa c3 98 43 81 83 58 fb df 64 e2 |b.FHH...C..X..d.|
+Server Write key[16]:
+| a2 26 cc 21 7e 20 1b 04 81 ad 69 c5 bf 1b 86 c5 |.&.!~ ....i.....|
+Client Write IV[16]:
+| 89 0b 05 b8 1b f3 f7 2f fa c6 98 1e 9c 4d 4c 68 |......./.....MLh|
+Server Write IV[16]:
+| 1c 61 a2 49 5a b2 90 2f fd 63 2a d8 4d 83 95 58 |.a.IZ../.c*.M..X|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #278 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6...
+looking for RSA pre-master49b0d526ec1cca1e189791ee6237d54b6d7a53ba163b9e3c...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 f9 36 0d be 36 69 c6 37 6a d8 79 cc f1 c8 26 |#.6..6i.7j.y...&|
+| a9 cb ee a4 e7 de 7b 36 19 a0 94 0b ef 52 34 bf |......{6.....R4.|
+| 23 c9 8a ee 73 6e 46 46 4b 7b 4f 69 76 63 d9 3b |#...snFFK{Oivc.;|
+| 19 4c fd 0f f6 ef 1f 56 43 e8 0e 54 c9 |.L.....VC..T. |
+hash out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+PRF out[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+key expansion[104]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 |.|.Y5./....A....|
+| ba 32 ac 6d 01 8a 04 61 4f 32 41 e7 55 47 90 32 |.2.m...aO2A.UG.2|
+| 66 e4 0b 57 ed d6 3d b0 e6 5e 04 6b c0 3f b5 c3 |f..W..=..^.k.?..|
+| 92 8e 62 c3 41 36 35 69 70 1b 35 77 16 97 09 d5 |..b.A65ip.5w....|
+| 9b bb 8f 8a 97 4d ec 20 4e 96 94 6c 84 a7 85 7a |.....M. N..l...z|
+| bb d4 14 ff 4f c3 ad f2 |....O... |
+Client MAC key[20]:
+| 3f 24 b6 52 fa db 57 42 5f 28 1a 2f 28 e1 78 f9 |?$.R..WB_(./(.x.|
+| 07 7c 8d 59 |.|.Y |
+Server MAC key[20]:
+| 35 8b 2f 00 b0 c0 1b 41 ca aa 11 83 ba 32 ac 6d |5./....A.....2.m|
+| 01 8a 04 61 |...a |
+Client Write key[16]:
+| 4f 32 41 e7 55 47 90 32 66 e4 0b 57 ed d6 3d b0 |O2A.UG.2f..W..=.|
+Server Write key[16]:
+| e6 5e 04 6b c0 3f b5 c3 92 8e 62 c3 41 36 35 69 |.^.k.?....b.A65i|
+Client Write IV[16]:
+| 70 1b 35 77 16 97 09 d5 9b bb 8f 8a 97 4d ec 20 |p.5w.........M. |
+Server Write IV[16]:
+| 4e 96 94 6c 84 a7 85 7a bb d4 14 ff 4f c3 ad f2 |N..l...z....O...|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| b1 dc 9b 8b 30 62 dc 3c 73 65 7d 43 aa aa ed 69 |....0b.<se}C...i|
+| 7f 78 38 e3 b7 dc 7c b9 b1 c0 e2 8a 88 7b b9 d2 |.x8...|......{..|
+| bf 9a 79 78 27 45 55 16 ab 1c 90 0c 58 f9 6e a2 |..yx'EU.....X.n.|
+| e1 db c0 93 38 8e f0 84 dc 14 9a 74 2a ef 00 8d |....8......t*...|
+Plaintext[64]:
+| 9c 5e 9a a2 97 8a 97 b1 82 74 11 37 7c fc 4d cb |.^.......t.7|.M.|
+| 14 00 00 0c 5e bb 06 48 45 bf 04 0d bd 2e 9d 16 |....^..HE.......|
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.,X.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d f5 e0 35 e2 51 7a c5 67 6d ea 23 e1 29 5f 4c |=..5.Qz.gm.#.)_L|
+| a2 2c 58 df |.,X. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #279 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 71 f8 9b 7a 5e 11 bb 24 38 93 87 db f1 2a dc 52 |q..z^..$8....*.R|
+| 5c 42 93 e9 1f 17 7d 49 8d ec a3 ad 98 25 40 01 |\B....}I.....%@.|
+| 59 a4 ed d0 10 3c f1 69 c8 78 a5 8d c4 ea e3 9b |Y....<.i.x......|
+| b6 88 46 90 cf 0e 6f 34 dc 6b ea df a9 53 70 3e |..F...o4.k...Sp>|
+Plaintext[64]:
+| 4c ca d8 e5 92 a5 96 fb 1d 54 52 e6 fd c1 06 64 |L........TR....d|
+| 14 00 00 0c 61 42 f8 38 c7 91 5d 72 b6 74 92 dc |....aB.8..]r.t..|
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |..p.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 5f fd 49 40 0a 16 5d 9e 08 ed 28 8f 62 28 56 fe |_.I@..]...(.b(V.|
+| a1 15 70 9d |..p. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #280 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 73 db 77 89 e3 a7 c9 fb 53 48 d3 2a 85 71 79 da |s.w.....SH.*.qy.|
+| f3 5b e0 ab d0 f7 a0 5d d2 43 06 6f 3c 01 9a c1 |.[.....].C.o<...|
+| 79 ba 05 f1 a0 67 3d 23 69 18 9c 2b 70 94 71 1c |y....g=#i..+p.q.|
+| 8d f4 25 e2 03 13 f4 91 e2 8c c1 46 43 1b ad a6 |..%........FC...|
+| 25 88 44 89 05 55 11 e8 be 9a b7 5b 72 48 2e a7 |%.D..U.....[rH..|
+| b9 a5 a6 6d dc 81 0f 09 45 ca 2c c2 c3 f0 b2 b8 |...m....E.,.....|
+| 87 8c 4c c6 a7 fe 6d 03 a0 fe 5e 6d 0b 80 08 14 |..L...m...^m....|
+Plaintext[112]:
+| 59 db 8a 5f e8 a2 a8 e7 ad 17 00 35 cd ef 3a 69 |Y.._.......5..:i|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 31 32 |Host: camellia12|
+| 38 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |8-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 35 |ekensteyn.nl:445|
+| 37 0d 0a 0d 0a 22 2d a5 65 9f 4f 66 55 39 1a 50 |7...."-.e.OfU9.P|
+| e1 09 71 ac 14 55 3d 43 4b 06 06 06 06 06 06 06 |..q..U=CK.......|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 10 58 a5 55 ab da cd ab 83 64 d5 c0 12 d4 df 14 |.X.U.....d......|
+| 01 a0 fa 18 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 50333 found (nil)
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #281 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 45 ec 2f af ab d8 64 59 62 19 e5 db 53 fd ab 59 |E./...dYb...S..Y|
+| c7 41 de 02 e9 9f 13 49 f3 7b 96 54 89 84 04 57 |.A.....I.{.T...W|
+| 0b b3 b4 99 7e 7e 8b 85 47 41 e7 0f 82 a9 d9 81 |....~~..GA......|
+| a1 10 f0 12 66 13 07 5f 17 64 12 80 b2 d1 aa 64 |....f.._.d.....d|
+| 87 9f 8c 63 f0 c3 d9 67 b0 e7 a2 3d 7d f7 86 4c |...c...g...=}..L|
+| a4 62 10 f4 46 67 53 19 14 ea 31 14 1a cd be a5 |.b..FgS...1.....|
+| fd 30 ec 60 31 4e 95 a6 1e 5c 4d c7 5a 5f 7c de |.0.`1N...\M.Z_|.|
+| 80 de b2 9a 93 c9 96 e8 76 95 1b 18 cb 95 e9 80 |........v.......|
+| 3b c7 78 11 14 45 90 42 42 44 19 bc 9f 5e 17 6b |;.x..E.BBD...^.k|
+| 56 06 de d4 52 c4 50 4e 2f 4b 8a 0e 24 b9 72 c0 |V...R.PN/K..$.r.|
+| 9b 03 d2 4f a8 3e 15 4c b4 58 8f 74 58 bb 2f 16 |...O.>.L.X.tX./.|
+| a0 6f 68 7d dd 15 89 37 9e 67 3a e0 84 a8 92 cd |.oh}...7.g:.....|
+| b8 1f 8c 7b d8 ec 8a ff 88 83 a6 bc 64 2a aa 08 |...{........d*..|
+| e5 54 1b 03 d9 2e 20 3e ca 17 03 51 0d ae 2e 7f |.T.... >...Q....|
+| d3 d1 df 7d 9e 98 1f 3d 14 51 ba c2 67 69 c6 8e |...}...=.Q..gi..|
+| 71 3e f6 01 06 4e 3a 16 47 27 f7 52 07 fb 01 ae |q>...N:.G'.R....|
+| eb 09 64 33 49 05 0e f3 33 1f 07 5b aa 2b 14 de |..d3I...3..[.+..|
+| f7 95 a2 c6 f1 8a a3 41 5e 25 3b be 59 b8 6d 4d |.......A^%;.Y.mM|
+| 88 91 77 e9 44 ab 6a 60 14 09 c9 0b 7f 60 9d 8c |..w.D.j`.....`..|
+| 1e c5 07 c6 9d 29 60 1f 6a 0a 93 dc 2e 14 f9 c3 |.....)`.j.......|
+| 5b 9f bf 36 59 44 25 09 e6 12 89 74 93 44 51 1a |[..6YD%....t.DQ.|
+| 00 34 af 2c 79 36 a5 08 6b 55 de 83 a0 ca cf 62 |.4.,y6..kU.....b|
+| f2 a2 9a 76 94 4b ed 96 34 5d 54 51 82 d9 9b 2b |...v.K..4]TQ...+|
+| 3a 1a 2e 2a 06 ec 48 50 ea 5f a4 2a 5f fd e1 f3 |:..*..HP._.*_...|
+| 1a ad f2 dc 1c ff 33 8c 68 f2 3d 95 ba e6 bc ac |......3.h.=.....|
+Plaintext[400]:
+| 9a c6 14 70 ac 6f a4 c0 1f c0 e8 49 a0 b9 99 b5 |...p.o.....I....|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 31 20 2d 20 43 41 4d 45 4c |x00,0x41 - CAMEL|
+| 4c 49 41 31 32 38 2d 53 48 41 20 20 20 20 20 20 |LIA128-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 7f 41 57 03 d3 08 fd 78 86 2b aa 3a b5 57 5e 78 |.AW....x.+.:.W^x|
+| 7d 5a 42 00 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |}ZB.............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 21 c6 d6 7a 18 f5 c7 4e cf 09 55 6b e0 e1 f1 a4 |!..z...N..Uk....|
+| 8b be e0 c5 |.... |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4457 found 0x3425860
+
+dissect_ssl enter frame #282 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 96 2c ce 53 2f df 3a cf 80 7e f0 f3 0e c5 48 eb |.,.S/.:..~....H.|
+| 58 26 21 2e b2 a2 78 e8 9a d4 be da fe d5 e1 9b |X&!...x.........|
+| 1c cb 21 4d 24 8f fc b5 1d dd 8f 6a 54 ba cd 98 |..!M$......jT...|
+Plaintext[48]:
+| 7b 05 0a ea 9a e5 6e e4 4d 05 35 38 59 b9 57 b7 |{.....n.M.58Y.W.|
+| 01 00 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b |......e....qq.0.|
+| f8 d5 21 8a 4b 7b 09 09 09 09 09 09 09 09 09 09 |..!.K{..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d ba d2 ab 65 15 b7 ee 16 71 71 10 30 9b f8 d5 |....e....qq.0...|
+| 21 8a 4b 7b |!.K{ |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #284 (first time)
+ conversation = 0x7facef999250, ssl_session = 0x7facc3839530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c3 77 31 8c 96 9d 3b 7c bf d8 24 fb a1 70 d4 a5 |.w1...;|..$..p..|
+| a0 b9 a5 5f 1e f9 1c a6 14 f1 f0 6f 05 dc eb ff |..._.......o....|
+| aa f3 aa da 25 41 1c 89 7f 9c 91 f3 cd cd aa 55 |....%A.........U|
+Plaintext[48]:
+| 64 cc 71 81 da 80 c2 c1 4b 7c e6 d9 f9 26 09 3e |d.q.....K|...&.>|
+| 01 00 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f |...pn_TF.1/....?|
+| 7c 4a 10 ee 54 13 09 09 09 09 09 09 09 09 09 09 ||J..T...........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9e 70 6e 5f 54 46 a1 31 2f c5 0c bc f1 3f 7c 4a |.pn_TF.1/....?|J|
+| 10 ee 54 13 |..T. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #289 (first time)
+ssl_session_init: initializing ptr 0x7facc383baf0 size 688
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 44746 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4458
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #291 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0044 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 9a 2c 35 22 34 27 d9 2a 88 d1 8f 6a bc 77 5a 32 |.,5"4'.*...j.wZ2|
+| 68 de 56 7e 9a ad f3 ec 4b ab d9 a9 25 61 00 9b |h.V~....K...%a..|
+| 0b 30 a1 d3 eb e3 c8 77 44 1f 98 8d fd 11 0d 43 |.0.....wD......C|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+PRF out[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+key expansion[104]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da |..M..V.).z...5..|
+| 5a eb 1b 81 e3 58 ec 44 29 3e 75 11 5e e1 37 30 |Z....X.D)>u.^.70|
+| 9b 49 ac ea 01 8f 95 b6 6a 87 90 52 1a c5 73 95 |.I......j..R..s.|
+| 2e 6d 7b e5 8b 02 ed 89 18 be a5 f3 a0 6c 5d cc |.m{..........l].|
+| ee 0b 94 bf ee d4 18 97 62 5b 3f ab 84 2d b7 3d |........b[?..-.=|
+| ea 1a ec 7e f5 de ea 12 |...~.... |
+Client MAC key[20]:
+| 5d e8 c0 0e a7 80 ea d2 c9 68 c6 08 73 ed fc 96 |]........h..s...|
+| 0a a8 4d a2 |..M. |
+Server MAC key[20]:
+| ed 56 fd 29 b8 7a 8c 11 e4 35 f6 da 5a eb 1b 81 |.V.).z...5..Z...|
+| e3 58 ec 44 |.X.D |
+Client Write key[16]:
+| 29 3e 75 11 5e e1 37 30 9b 49 ac ea 01 8f 95 b6 |)>u.^.70.I......|
+Server Write key[16]:
+| 6a 87 90 52 1a c5 73 95 2e 6d 7b e5 8b 02 ed 89 |j..R..s..m{.....|
+Client Write IV[16]:
+| 18 be a5 f3 a0 6c 5d cc ee 0b 94 bf ee d4 18 97 |.....l].........|
+Server Write IV[16]:
+| 62 5b 3f ab 84 2d b7 3d ea 1a ec 7e f5 de ea 12 |b[?..-.=...~....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #293 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f...
+looking for RSA pre-master008032041c81e691596ba5ab0fbf45b29c5f64c0e2d8dcd8...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 0c 19 8a b6 1d 09 aa 16 a9 50 bc d6 2b b0 f1 |#.........P..+..|
+| 1e a8 83 58 08 36 04 0b be 22 b6 6c e7 52 34 bf |...X.6...".l.R4.|
+| 23 48 94 c7 dd 68 85 6e 2c 8b 74 c8 8d 5d 88 e3 |#H...h.n,.t..]..|
+| ae 0f de e3 6f 97 47 a3 23 9d 3c a1 0d |....o.G.#.<.. |
+hash out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+PRF out[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+key expansion[104]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 |fn. ..#...~:6..$|
+| 52 93 70 4a 12 e4 9c 7f 08 1c d3 36 74 e5 12 9c |R.pJ.......6t...|
+| d8 83 fb c2 0d 56 25 d3 58 ac 0e e3 57 2d fa 10 |.....V%.X...W-..|
+| b7 fb 9b 3e 5d d1 c8 1d b3 67 57 e3 04 c7 25 ed |...>]....gW...%.|
+| 97 21 bd 41 7a 2e 87 6e 4b c9 01 2e 82 70 53 01 |.!.Az..nK....pS.|
+| 71 41 ef 52 83 75 18 62 |qA.R.u.b |
+Client MAC key[20]:
+| 81 17 09 f2 85 03 c6 e3 3c dc b1 ba 29 cd 46 8d |........<...).F.|
+| 66 6e 7f 20 |fn. |
+Server MAC key[20]:
+| 8f c0 23 a7 84 dd 7e 3a 36 fd 18 24 52 93 70 4a |..#...~:6..$R.pJ|
+| 12 e4 9c 7f |.... |
+Client Write key[16]:
+| 08 1c d3 36 74 e5 12 9c d8 83 fb c2 0d 56 25 d3 |...6t........V%.|
+Server Write key[16]:
+| 58 ac 0e e3 57 2d fa 10 b7 fb 9b 3e 5d d1 c8 1d |X...W-.....>]...|
+Client Write IV[16]:
+| b3 67 57 e3 04 c7 25 ed 97 21 bd 41 7a 2e 87 6e |.gW...%..!.Az..n|
+Server Write IV[16]:
+| 4b c9 01 2e 82 70 53 01 71 41 ef 52 83 75 18 62 |K....pS.qA.R.u.b|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 76 ee 05 b3 ce 43 54 ae b7 42 80 62 99 39 5e 96 |v....CT..B.b.9^.|
+| fe d1 a1 fe 08 a5 93 da a2 46 2b 02 e6 7a f3 d0 |.........F+..z..|
+| 20 af 2c 26 3b 07 89 48 c0 6a 0e a2 16 ec b9 c6 | .,&;..H.j......|
+| 90 d0 c7 7a aa ca d2 f0 02 23 2d b9 e5 48 4f 0f |...z.....#-..HO.|
+Plaintext[64]:
+| d4 53 7a 8c d2 0b 73 47 f2 f9 27 88 99 10 ee 46 |.Sz...sG..'....F|
+| 14 00 00 0c b0 2d f1 76 d2 be 56 e4 9d e9 0a 53 |.....-.v..V....S|
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |`y.Y............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 a5 0d 3b 37 4b 4d cf 88 39 76 37 96 a7 d0 ef |...;7KM..9v7....|
+| 60 79 d0 59 |`y.Y |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #294 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 28 a6 e6 11 e9 7a 6a 68 9c 1b 91 91 4b d9 f7 b4 |(....zjh....K...|
+| 74 cb a2 a1 67 0c 63 a5 ac 46 e4 db 84 fd 8e 66 |t...g.c..F.....f|
+| 27 15 b4 2f 3c 19 3e d0 1a 3d a7 47 6a 4c eb e0 |'../<.>..=.GjL..|
+| 67 77 56 3d df 69 e7 b4 c5 87 83 34 30 fc 91 38 |gwV=.i.....40..8|
+Plaintext[64]:
+| 52 04 27 46 3c 6c 26 04 af eb 2d 3f ff 19 31 c3 |R.'F<l&...-?..1.|
+| 14 00 00 0c 26 5c cb b9 4b a0 62 cb 2e b0 f2 18 |....&\..K.b.....|
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.q'`............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e0 a7 96 53 5d 08 11 43 3e c4 6d bb 16 a4 36 31 |...S]..C>.m...61|
+| b9 71 27 60 |.q'` |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #295 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 12 20 e2 74 2a 11 c4 10 ed a0 aa a7 23 ca 38 c3 |. .t*.......#.8.|
+| f4 3d 4b 06 32 ed ff 62 b8 42 e4 ed c8 86 39 74 |.=K.2..b.B....9t|
+| 3b 71 af c4 0e 97 b6 7c 2a ef ef 92 d0 01 fc bd |;q.....|*.......|
+| 78 65 81 6e e2 cb 1b 6d 28 a4 60 2a 75 ba 35 e6 |xe.n...m(.`*u.5.|
+| 97 f8 04 9c fa d3 3c 07 30 7e 27 66 4f 19 33 3b |......<.0~'fO.3;|
+| 7a c1 33 d7 ef 7a a5 59 53 15 05 7c bf dc d7 08 |z.3..z.YS..|....|
+| e4 17 a2 d5 08 2c 89 eb 40 8a 07 19 90 28 52 29 |.....,..@....(R)|
+| 69 af 4f 26 e7 99 f5 2f 54 59 ca 03 f6 a7 c1 a6 |i.O&.../TY......|
+Plaintext[128]:
+| a7 c0 77 b3 8c 76 cc 8c 41 50 49 ef 86 d3 0c 3f |..w..v..API....?|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 38 0d 0a 0d 0a c6 c4 f2 |n.nl:4458.......|
+| 60 32 67 48 e0 11 bc 98 89 66 b5 48 48 38 2d ae |`2gH.....f.HH8-.|
+| a8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 15 32 91 17 d5 ed 1a c3 1c ab 40 d5 3e c9 2b 25 |.2........@.>.+%|
+| bb 4b 6f be |.Ko. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 44746 found (nil)
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #296 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fd a4 cd 1c ed 1b 11 1a d1 45 ee 85 7a 0f 23 3b |.........E..z.#;|
+| 3e 3f 2a 0e 17 28 88 92 f2 19 9b f9 e8 f7 ff 34 |>?*..(.........4|
+| 8b 11 11 9f 63 f7 ff 22 5d a0 3f b1 9a 94 c0 d4 |....c.."].?.....|
+| 21 17 f6 ff d8 a0 1c cf 03 b0 27 35 51 34 25 0e |!.........'5Q4%.|
+| 6e cb fa 41 3e 34 c5 f4 27 b6 59 bc 5d ae 8e c1 |n..A>4..'.Y.]...|
+| 12 48 ef 40 91 5a f1 42 e3 02 6a 54 29 f9 05 19 |.H.@.Z.B..jT)...|
+| e0 21 01 17 69 a8 84 35 08 ea 09 e2 dd 1c 54 00 |.!..i..5......T.|
+| 3c 2d 7d 9a f0 10 4d c3 c6 cf 5e 09 ff d0 01 51 |<-}...M...^....Q|
+| 78 f0 63 42 9a 58 1d b4 30 4a 40 50 df 39 06 56 |x.cB.X..0J@P.9.V|
+| 3e b4 ec 9d 64 09 f0 8e d6 be 4f e3 48 33 68 b5 |>...d.....O.H3h.|
+| 94 d5 f6 db 96 e7 8e 18 2b fc 5d 5f c6 2e d7 2d |........+.]_...-|
+| 99 73 c3 f4 dd 37 54 b1 f2 5f d8 c9 de 5f bb 69 |.s...7T.._..._.i|
+| 39 68 34 8f 49 24 ca 77 e0 f0 13 20 eb c7 01 92 |9h4.I$.w... ....|
+| b6 b8 6f de 78 28 37 5a 09 69 41 2a db 3d 62 a4 |..o.x(7Z.iA*.=b.|
+| 23 1f af 54 b3 ce 6e 4e 71 35 d2 e0 db 1d 02 1f |#..T..nNq5......|
+| f8 33 d1 97 cb d7 a5 c6 f9 46 b6 98 ff 9b 26 15 |.3.......F....&.|
+| de 38 ea 5d c1 1c e2 8e 62 7d 16 c1 51 c9 ba 53 |.8.]....b}..Q..S|
+| fe 48 8e df b0 90 c5 f5 57 cd 82 31 60 3f d9 c8 |.H......W..1`?..|
+| 22 a7 34 fd 28 2c c6 59 81 df bd 53 a8 85 54 6c |".4.(,.Y...S..Tl|
+| 57 b4 6d ea d8 16 fa 9b 1b 6e 46 8d 66 6c c7 bd |W.m......nF.fl..|
+| 95 d7 0e 3c 44 84 d4 d9 cd f4 93 01 04 54 9a d8 |...<D........T..|
+| be b7 b1 d2 c3 3d 58 44 6d aa 8f 02 32 27 e7 6c |.....=XDm...2'.l|
+| 1b e3 04 0a 99 dd 11 82 03 d7 df 8f 70 f1 b7 a3 |............p...|
+| ae 81 ce de f5 4f 5a f9 fa 7f 51 cc 92 69 5d cc |.....OZ...Q..i].|
+| 2f 97 5e 55 b2 cf 22 0f 1b f3 70 92 82 d6 5d 3b |/.^U.."...p...];|
+Plaintext[400]:
+| 16 66 ed 93 a4 97 21 1f 54 59 42 ce 75 fd ce 8e |.f....!.TYB.u...|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 34 20 2d 20 44 48 45 2d 44 |x00,0x44 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SS-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 58 05 86 66 e9 10 03 7d 14 04 31 53 69 a1 b6 13 |X..f...}..1Si...|
+| 82 52 ac c3 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.R..............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| b4 8e f2 0c 2c 53 73 b8 87 7c 12 33 34 a4 d9 fe |....,Ss..|.34...|
+| be 8b 6d f5 |..m. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4458 found 0x34258f0
+
+dissect_ssl enter frame #297 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 7d e0 a4 b5 95 8c d7 b4 f5 da c6 ce fa 28 84 19 |}............(..|
+| db 25 fa 66 97 d7 3e fa 01 9f 25 8c cd ac 46 d2 |.%.f..>...%...F.|
+| b4 8a 04 b8 4b 0a 1d 9c 47 56 42 1f 6e 4b 03 5a |....K...GVB.nK.Z|
+Plaintext[48]:
+| e2 80 85 77 af ee bc a5 4c 1a 9d 71 01 fe c3 58 |...w....L..q...X|
+| 01 00 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 |...V......X3).!0|
+| 49 74 f0 be 0c ce 09 09 09 09 09 09 09 09 09 09 |It..............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8a 56 eb f7 cc ad 7f 84 58 33 29 e6 21 30 49 74 |.V......X3).!0It|
+| f0 be 0c ce |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #299 (first time)
+ conversation = 0x7facef9994f8, ssl_session = 0x7facc383baf0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9d 88 b2 b6 f1 fc 08 ad 12 97 a1 40 80 72 24 7a |...........@.r$z|
+| a4 a8 28 0f c5 e2 ea ae ba 03 5f 95 27 76 48 e1 |..(......._.'vH.|
+| ed 5d 38 23 df a1 83 bb da 3d 2a 07 21 0e 36 18 |.]8#.....=*.!.6.|
+Plaintext[48]:
+| 7a 2c 25 f8 59 43 18 2f ea e6 a5 68 1a 1d 12 cc |z,%.YC./...h....|
+| 01 00 ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 |...i..../}$.}...|
+| a1 84 50 3f a2 ed 09 09 09 09 09 09 09 09 09 09 |..P?............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ef 69 16 d4 c5 9a 2f 7d 24 f7 7d 0d 8c a6 a1 84 |.i..../}$.}.....|
+| 50 3f a2 ed |P?.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #304 (first time)
+ssl_session_init: initializing ptr 0x7facc383dff0 size 688
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45627 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4459
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #306 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0045 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 59 77 8a 78 2c fe e9 99 fc 9e 66 cd 62 7c ee 93 |Yw.x,.....f.b|..|
+| e4 3d 2e c9 7d 28 55 81 68 e0 08 f0 76 9e 5d 36 |.=..}(U.h...v.]6|
+| 6d 3c da 09 b0 33 fa 5d db 7e f4 c7 ac a0 5d d1 |m<...3.].~....].|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+PRF out[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+key expansion[104]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f 93 9b ba 45 ab 1e a7 34 64 aa 88 3e |.J|....E...4d..>|
+| 3b c5 33 e5 da 1e 6d da 58 a3 23 dc 5e ce be 49 |;.3...m.X.#.^..I|
+| 78 ff 86 f6 40 24 f8 6b 2b c9 6b a8 3f b3 63 ae |x...@$.k+.k.?.c.|
+| 7f a9 61 33 d5 2a 35 5a 59 eb 97 39 0a 95 4d 35 |..a3.*5ZY..9..M5|
+| 52 6a e2 b7 e4 43 11 97 b3 3f 16 f1 cf 48 de cb |Rj...C...?...H..|
+| 3d 96 4c 6b 90 e7 14 ed |=.Lk.... |
+Client MAC key[20]:
+| db fb b6 62 90 ab 89 a3 ff 46 77 c0 41 1e a3 16 |...b.....Fw.A...|
+| e3 4a 7c 1f |.J|. |
+Server MAC key[20]:
+| 93 9b ba 45 ab 1e a7 34 64 aa 88 3e 3b c5 33 e5 |...E...4d..>;.3.|
+| da 1e 6d da |..m. |
+Client Write key[16]:
+| 58 a3 23 dc 5e ce be 49 78 ff 86 f6 40 24 f8 6b |X.#.^..Ix...@$.k|
+Server Write key[16]:
+| 2b c9 6b a8 3f b3 63 ae 7f a9 61 33 d5 2a 35 5a |+.k.?.c...a3.*5Z|
+Client Write IV[16]:
+| 59 eb 97 39 0a 95 4d 35 52 6a e2 b7 e4 43 11 97 |Y..9..M5Rj...C..|
+Server Write IV[16]:
+| b3 3f 16 f1 cf 48 de cb 3d 96 4c 6b 90 e7 14 ed |.?...H..=.Lk....|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #308 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cf...
+looking for RSA pre-master00804d7ad45959353a60dbb7bc3b8677ddfe7950df38c6cb...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 67 b0 df 0c 44 2d e4 e0 d5 67 b4 e9 64 20 58 |#g...D-...g..d X|
+| 56 a3 83 25 b3 ba 49 2f ee e4 b2 be ed 52 34 bf |V..%..I/.....R4.|
+| 23 7d d6 d1 44 fb ee a4 16 dc 5b 5a f1 72 80 ce |#}..D.....[Z.r..|
+| 44 f1 5f e2 cf f0 c8 45 ca db 21 46 a0 |D._....E..!F. |
+hash out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+PRF out[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+key expansion[104]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 |..$Q...Il....%o.|
+| 54 df 97 7c 72 3c e3 dd 47 95 1d cb 70 fd a0 9d |T..|r<..G...p...|
+| 2f a5 29 f8 a9 cb 2f 13 35 4d 4c a5 32 67 92 76 |/.).../.5ML.2g.v|
+| 1b fc dd 73 b1 cc ad d6 ac b6 89 a7 36 1a 35 fb |...s........6.5.|
+| 76 13 5c 55 8e 01 a8 93 23 dd 9c 11 49 ad 1d 14 |v.\U....#...I...|
+| 19 7b 40 5a 67 ae 1d 43 |.{@Zg..C |
+Client MAC key[20]:
+| a0 8c 19 b4 58 17 91 26 71 db 06 ae 76 60 a7 97 |....X..&q...v`..|
+| dc ee 24 51 |..$Q |
+Server MAC key[20]:
+| 18 b2 c9 49 6c 18 16 cc 1e 25 6f 16 54 df 97 7c |...Il....%o.T..||
+| 72 3c e3 dd |r<.. |
+Client Write key[16]:
+| 47 95 1d cb 70 fd a0 9d 2f a5 29 f8 a9 cb 2f 13 |G...p.../.).../.|
+Server Write key[16]:
+| 35 4d 4c a5 32 67 92 76 1b fc dd 73 b1 cc ad d6 |5ML.2g.v...s....|
+Client Write IV[16]:
+| ac b6 89 a7 36 1a 35 fb 76 13 5c 55 8e 01 a8 93 |....6.5.v.\U....|
+Server Write IV[16]:
+| 23 dd 9c 11 49 ad 1d 14 19 7b 40 5a 67 ae 1d 43 |#...I....{@Zg..C|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA128
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 89 31 47 3e d2 51 cd 32 0e c5 14 19 f7 3d 2d 99 |.1G>.Q.2.....=-.|
+| 8c 35 a5 3d df eb 96 83 17 2c d2 22 7a b0 ab 8d |.5.=.....,."z...|
+| dc 7c 40 af c7 93 e7 e8 32 94 8f 81 86 41 6a d4 |.|@.....2....Aj.|
+| 4e 77 72 44 28 3a d7 73 1c e3 2d 96 49 e4 4b 67 |NwrD(:.s..-.I.Kg|
+Plaintext[64]:
+| cc 32 e8 ed f2 bd aa a3 1c e7 4e 18 12 54 3b cb |.2........N..T;.|
+| 14 00 00 0c 56 fa fb b6 f1 01 61 53 6b e7 f2 16 |....V.....aSk...|
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |a!..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 31 5f 78 75 2a 86 17 2c bd 67 aa 9a 44 0f 39 0b |1_xu*..,.g..D.9.|
+| 61 21 f0 d5 |a!.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #309 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 6f 7d 75 d5 68 e8 50 bf 56 74 e2 31 32 50 be cd |o}u.h.P.Vt.12P..|
+| 7e 76 21 ef f4 4a f9 5e f1 4b 32 fe 4d 66 8b a7 |~v!..J.^.K2.Mf..|
+| 26 d4 1b 36 26 ab 52 90 0f d0 b3 62 1f e0 65 1b |&..6&.R....b..e.|
+| f8 4f 61 3b 8d 91 3f 2d 02 03 ba 60 a5 f4 8c ee |.Oa;..?-...`....|
+Plaintext[64]:
+| 31 53 dd d4 5b 02 e9 48 30 8d f1 3d 8b f1 04 25 |1S..[..H0..=...%|
+| 14 00 00 0c 7a 76 e1 e0 89 d8 c7 5b 54 3c c2 99 |....zv.....[T<..|
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |'.H.............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ff b6 ed cf 90 94 b2 a4 99 e2 13 de 8b 5d c5 28 |.............].(|
+| 27 9e 48 0b |'.H. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #310 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| d2 7a a9 6b d2 35 c6 d3 63 d3 68 6b 62 1c c1 96 |.z.k.5..c.hkb...|
+| bb 3d 71 8c dd 9f d6 05 e4 7d ad 8a 7d be de 5b |.=q......}..}..[|
+| 8f 8c 2f 09 a5 03 c1 01 9a d5 f1 41 93 71 1a 1c |../........A.q..|
+| 1d 67 7e c4 01 1b 6b 0d 77 d8 c3 66 85 b4 3c 42 |.g~...k.w..f..<B|
+| d9 e4 d0 f9 a2 3e 16 35 26 bd 7b 0d ee 30 25 eb |.....>.5&.{..0%.|
+| be 0f 33 92 01 16 47 88 af be 92 f4 ee 66 8c 37 |..3...G......f.7|
+| 1a a4 2e 6f 6d 01 a6 ad 7c 55 a7 d0 47 a8 fe f6 |...om...|U..G...|
+| 05 9e 7c ed a1 ea 1e a3 ee 6e 46 92 26 b0 02 8a |..|......nF.&...|
+Plaintext[128]:
+| a0 ef 57 7a 37 3a 92 ca 76 dd d5 36 59 33 69 6e |..Wz7:..v..6Y3in|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 31 32 38 2d 73 68 61 2e 6c 6f |mellia128-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 35 39 0d 0a 0d 0a 3d 98 be |n.nl:4459....=..|
+| ad c3 82 26 b5 c4 04 26 ab 26 e3 c4 0b 51 75 e6 |...&...&.&...Qu.|
+| 2d 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |-...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 03 48 86 ee fb d5 a2 b3 65 e6 04 af 0b 04 61 72 |.H......e.....ar|
+| b0 ed 40 70 |..@p |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45627 found (nil)
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #311 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d3 f6 28 f3 d3 92 1b 76 e1 8d 33 fa 6a f0 5f 26 |..(....v..3.j._&|
+| 15 48 68 96 f8 26 f3 50 ed 3a be 5d ee c4 72 d2 |.Hh..&.P.:.]..r.|
+| 22 46 c9 20 d4 ea 27 8e a2 be 42 98 92 a7 ab db |"F. ..'...B.....|
+| 25 cb 67 3c b9 5e 10 f5 1b 99 7b 2c 62 d1 ff d6 |%.g<.^....{,b...|
+| 15 d2 35 37 7f 6c 38 a9 15 a2 e8 9f 43 53 dd 85 |..57.l8.....CS..|
+| 1e a8 11 03 4a 4d da 0a cc 4c 39 f6 e2 dd b7 27 |....JM...L9....'|
+| 71 7d 52 18 d5 5e 11 c0 81 be 94 53 38 59 a4 12 |q}R..^.....S8Y..|
+| f2 0a f6 60 19 db 0c dd fa 81 ba f9 3f c0 53 ee |...`........?.S.|
+| 67 f3 04 88 04 47 6e 60 98 cb f2 85 a7 1e f4 ef |g....Gn`........|
+| a7 af bb a1 a6 6e 77 d9 ff e7 16 ce 12 99 77 eb |.....nw.......w.|
+| 3c ff 72 63 95 51 49 51 27 74 58 78 11 59 c8 8a |<.rc.QIQ'tXx.Y..|
+| cf f7 c9 dc 54 24 43 0e 67 a4 cd bf 04 65 f2 5a |....T$C.g....e.Z|
+| e0 58 29 27 c9 f2 51 51 b6 0e e7 b2 20 ad 31 f7 |.X)'..QQ.... .1.|
+| d6 7f 1d 01 02 f0 6c 28 e1 0a 4c 06 75 96 13 68 |......l(..L.u..h|
+| e2 36 33 79 8f c8 9b 9d 69 ba 41 a6 70 44 2c 1b |.63y....i.A.pD,.|
+| 90 e5 ea 22 ee 70 96 cf e2 50 b6 b1 f7 56 66 8b |...".p...P...Vf.|
+| 06 ba fc 8c e3 68 d0 29 6c 50 3c 74 da 97 26 f1 |.....h.)lP<t..&.|
+| b7 da e8 79 80 52 45 1e 2a 5d 11 79 c1 6b 0e 65 |...y.RE.*].y.k.e|
+| 62 a8 eb 00 39 c7 b2 6e 6f f8 ab 9e a7 fe 15 53 |b...9..no......S|
+| 6a bf 96 0a 9a cf 20 13 60 9e a5 88 d1 5c c1 2e |j..... .`....\..|
+| 7e 7f 6c d1 cf e7 a4 f7 7b 0f 07 87 db 64 77 83 |~.l.....{....dw.|
+| 34 09 99 14 a7 0e a2 ab 08 e3 87 ee 12 7b 70 a5 |4............{p.|
+| 2d bd 55 3f d6 91 66 fa 7d 76 c9 62 b1 b1 b8 94 |-.U?..f.}v.b....|
+| ac 09 51 4e 28 fb e2 dc af 18 c1 30 ce bf 99 21 |..QN(......0...!|
+| 44 9a 9f 41 4a 4e da dd b8 1e 3c 55 b0 e3 8f e9 |D..AJN....<U....|
+Plaintext[400]:
+| d6 64 5d 94 4d 17 cc d5 18 1f 6c 6a 59 ff 69 e4 |.d].M.....ljY.i.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 34 35 20 2d 20 44 48 45 2d 52 |x00,0x45 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 31 32 38 2d 53 |SA-CAMELLIA128-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 31 32 38 29 20 4d |=Camellia(128) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| e7 07 5d 56 06 9f 5f 9e 62 c4 ac 44 5a 46 88 08 |..]V.._.b..DZF..|
+| c0 5d a9 25 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.].%............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9a 34 f7 7e ac a3 fa 2d d9 6e 32 9d d8 53 af f5 |.4.~...-.n2..S..|
+| 41 dc e8 24 |A..$ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4459 found 0x3328090
+
+dissect_ssl enter frame #312 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 3e 26 3f 1a 0f b8 ba 30 38 51 ba 0e 2b d6 7e f9 |>&?....08Q..+.~.|
+| 17 63 34 f2 5f 32 d7 d5 15 42 95 9a b6 2f 32 93 |.c4._2...B.../2.|
+| d3 b8 c2 8b ff fd 10 c6 81 d3 72 db d6 d6 ad 44 |..........r....D|
+Plaintext[48]:
+| 56 2c b3 ff 6c 96 0e c4 f5 ad a3 87 c5 99 04 71 |V,..l..........q|
+| 01 00 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 |..J;...f.?(.,...|
+| ca a8 13 ec 1f 4a 09 09 09 09 09 09 09 09 09 09 |.....J..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 4a 3b 09 17 19 66 8f 3f 28 97 2c 1e 85 96 ca a8 |J;...f.?(.,.....|
+| 13 ec 1f 4a |...J |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #314 (first time)
+ conversation = 0x7facef9997a0, ssl_session = 0x7facc383dff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| fb 15 dc 4b ab c1 4d f4 ce 06 a6 27 76 3f 01 4a |...K..M....'v?.J|
+| 2e 5e 4e 52 c0 9e a8 56 e2 9c 03 e8 54 2c 65 34 |.^NR...V....T,e4|
+| 30 92 c7 5d 78 d8 50 ab ab 09 47 fa 22 51 55 b9 |0..]x.P...G."QU.|
+Plaintext[48]:
+| 7d 23 d5 16 80 35 92 c6 14 53 8c 1c bb c3 7a 2f |}#...5...S....z/|
+| 01 00 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 |...:.6..FN..,...|
+| 6d 6b 10 bb 5d 2a 09 09 09 09 09 09 09 09 09 09 |mk..]*..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 0a 3a e3 36 ee fc 46 4e a0 c9 2c ac ca e2 6d 6b |.:.6..FN..,...mk|
+| 10 bb 5d 2a |..]* |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #319 (first time)
+ssl_session_init: initializing ptr 0x7facc3840530 size 688
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 45960 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4463
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #321 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0084 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 98 f4 4c 2f 4f da d3 39 63 dd d5 5c 49 fa a0 75 |..L/O..9c..\I..u|
+| d6 89 68 83 d7 7c 9d 95 2e 54 1b 96 d1 75 c5 09 |..h..|...T...u..|
+| 0a 3e e8 51 c3 d1 c2 fe b8 02 54 6b 68 9f 08 f2 |.>.Q......Tkh...|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+PRF out[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+key expansion[136]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 76 10 cc d5 50 2a 86 bd 16 07 49 53 |....v...P*....IS|
+| f7 d3 3e 3c 17 28 b4 b8 a2 ab 9c b8 88 7c b6 2e |..><.(.......|..|
+| 70 e2 d1 ca c8 11 9b e0 4a 52 46 48 3b e9 8d f6 |p.......JRFH;...|
+| 11 09 8d 54 62 29 25 48 bd 6c 26 ac 29 7e d2 e5 |...Tb)%H.l&.)~..|
+| 0a e0 d9 a1 75 fd cd 1a 6a f1 6d d3 f8 83 be 47 |....u...j.m....G|
+| d0 99 fe 8b 13 46 0a e6 b6 15 ee a8 55 22 16 51 |.....F......U".Q|
+| cb cc f2 cc 09 cf 21 3c c3 b5 2e 5b e3 bb a8 86 |......!<...[....|
+| 70 55 ea f6 83 1f f8 6f |pU.....o |
+Client MAC key[20]:
+| 2a bf ab e9 44 c8 f2 3b 6c 69 29 fa 8c 82 10 81 |*...D..;li).....|
+| 90 98 ac f1 |.... |
+Server MAC key[20]:
+| 76 10 cc d5 50 2a 86 bd 16 07 49 53 f7 d3 3e 3c |v...P*....IS..><|
+| 17 28 b4 b8 |.(.. |
+Client Write key[32]:
+| a2 ab 9c b8 88 7c b6 2e 70 e2 d1 ca c8 11 9b e0 |.....|..p.......|
+| 4a 52 46 48 3b e9 8d f6 11 09 8d 54 62 29 25 48 |JRFH;......Tb)%H|
+Server Write key[32]:
+| bd 6c 26 ac 29 7e d2 e5 0a e0 d9 a1 75 fd cd 1a |.l&.)~......u...|
+| 6a f1 6d d3 f8 83 be 47 d0 99 fe 8b 13 46 0a e6 |j.m....G.....F..|
+Client Write IV[16]:
+| b6 15 ee a8 55 22 16 51 cb cc f2 cc 09 cf 21 3c |....U".Q......!<|
+Server Write IV[16]:
+| c3 b5 2e 5b e3 bb a8 86 70 55 ea f6 83 1f f8 6f |...[....pU.....o|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #323 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6...
+looking for RSA pre-master28a5e5ae37eb7d5c1b3740154edc21c244ade2aa80b2c5a9...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 23 6a eb c0 e2 35 e7 d6 88 c3 0c 0a 78 1a a2 47 |#j...5......x..G|
+| 5a 4f 3a 0a 2b 1b 1f 3e 46 02 23 2d f4 52 34 bf |ZO:.+..>F.#-.R4.|
+| 23 8f 8b 52 e2 71 f6 a8 35 0d 2f 2a f8 85 d5 e6 |#..R.q..5./*....|
+| 89 0f 54 a3 c6 68 7b 98 72 20 c0 aa 3d |..T..h{.r ..= |
+hash out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+PRF out[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+key expansion[136]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 |..|..,i.........|
+| 9d a1 9f 69 e6 49 d6 dd ef fc d6 9e 44 fc 5f 81 |...i.I......D._.|
+| 35 02 8b 36 64 82 23 43 30 74 6a cd 9f ea 1e 8a |5..6d.#C0tj.....|
+| 49 74 50 3d 3b 5c f2 4b 73 02 65 23 da 1f 5a d8 |ItP=;\.Ks.e#..Z.|
+| ed 23 88 ca f4 e1 83 d7 e4 07 4c ba cf 48 9b ef |.#........L..H..|
+| cd b1 86 a0 57 8a 98 41 9f ed 72 49 5d 55 79 e5 |....W..A..rI]Uy.|
+| 50 72 78 77 39 7c be cf 01 f6 41 cf 24 03 3d 64 |Prxw9|....A.$.=d|
+| be 57 98 9c ce ad e6 5a |.W.....Z |
+Client MAC key[20]:
+| 1e e9 75 7a 04 27 a2 72 7a 40 2b 52 8c 41 ea cc |..uz.'.rz@+R.A..|
+| c9 aa 7c 14 |..|. |
+Server MAC key[20]:
+| 9e 2c 69 95 ff 18 8f 18 c2 dc 11 94 9d a1 9f 69 |.,i............i|
+| e6 49 d6 dd |.I.. |
+Client Write key[32]:
+| ef fc d6 9e 44 fc 5f 81 35 02 8b 36 64 82 23 43 |....D._.5..6d.#C|
+| 30 74 6a cd 9f ea 1e 8a 49 74 50 3d 3b 5c f2 4b |0tj.....ItP=;\.K|
+Server Write key[32]:
+| 73 02 65 23 da 1f 5a d8 ed 23 88 ca f4 e1 83 d7 |s.e#..Z..#......|
+| e4 07 4c ba cf 48 9b ef cd b1 86 a0 57 8a 98 41 |..L..H......W..A|
+Client Write IV[16]:
+| 9f ed 72 49 5d 55 79 e5 50 72 78 77 39 7c be cf |..rI]Uy.Prxw9|..|
+Server Write IV[16]:
+| 01 f6 41 cf 24 03 3d 64 be 57 98 9c ce ad e6 5a |..A.$.=d.W.....Z|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 47 fb 9b b3 2e b2 65 44 ee 57 a7 f1 85 8e 12 a1 |G.....eD.W......|
+| 43 56 d0 2e c9 23 46 5d a9 c9 7f 35 75 35 a4 fa |CV...#F]...5u5..|
+| 1d 43 9f b0 05 db f4 90 e4 df 2f 14 44 90 35 18 |.C......../.D.5.|
+| 4d 12 bb 03 57 22 96 b0 08 46 02 de df 62 98 d7 |M...W"...F...b..|
+Plaintext[64]:
+| 24 b4 d0 d7 36 77 13 dc 8e d1 bc 52 c6 d7 7f f8 |$...6w.....R....|
+| 14 00 00 0c a4 a1 8e 8a a4 ee 69 b8 73 ed e5 91 |..........i.s...|
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...l............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| fc 11 11 1d 58 95 59 25 31 52 da eb df 06 8e 99 |....X.Y%1R......|
+| 88 11 12 6c |...l |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #324 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 02 72 8d d9 a7 0e 3f 32 a1 e9 0b 9f 93 f6 7e 34 |.r....?2......~4|
+| 39 23 ae 0d eb d7 b8 44 bb 2f 93 f1 83 35 24 22 |9#.....D./...5$"|
+| 78 28 7f 03 8a 3c 74 83 27 0d b0 fb 46 56 6d 91 |x(...<t.'...FVm.|
+| ae 8e 54 fd 98 a1 74 ee 33 9d 2d aa 65 29 5c 4c |..T...t.3.-.e)\L|
+Plaintext[64]:
+| f6 d4 9b d1 5c 7b 6d c4 f5 f2 79 77 23 cf 7f cb |....\{m...yw#...|
+| 14 00 00 0c 60 5d 71 3c 03 df f1 a7 bc 91 99 b7 |....`]q<........|
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |[ .9............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 79 41 a0 dd dd af 7e 3b 97 5f 72 73 91 8d a7 |zyA....~;._rs...|
+| 5b 20 05 39 |[ .9 |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #325 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 85 78 9f 2c 72 2b 33 2b 32 cd 87 d8 24 ea 0c 37 |.x.,r+3+2...$..7|
+| 33 4e 2b 57 19 b4 54 55 6e b2 98 88 c0 d7 58 9a |3N+W..TUn.....X.|
+| 89 25 44 55 9c 04 71 00 9a 0b 52 d9 6d 3e 77 e8 |.%DU..q...R.m>w.|
+| a5 91 88 b0 1e 61 8e 98 3f 31 23 63 47 91 59 31 |.....a..?1#cG.Y1|
+| d1 d1 bb ab f8 d5 d5 a2 5f 1c 96 79 20 6c e3 65 |........_..y l.e|
+| db 3d 7f b2 be d9 e5 31 86 23 02 f6 01 a8 c6 92 |.=.....1.#......|
+| 20 5a 32 85 59 28 18 ea f7 d6 aa 87 1b c8 1c 5a | Z2.Y(.........Z|
+Plaintext[112]:
+| 85 d9 c4 10 d3 53 d3 34 da 45 35 ae 4d 4a 96 13 |.....S.4.E5.MJ..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 63 61 6d 65 6c 6c 69 61 32 35 |Host: camellia25|
+| 36 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e 6c |6-sha.local.al.l|
+| 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 36 |ekensteyn.nl:446|
+| 33 0d 0a 0d 0a 9b ae 04 4b b5 f7 b2 5c 7b 34 a9 |3.......K...\{4.|
+| cc 22 b4 7d b9 ed 9b 6c 13 06 06 06 06 06 06 06 |.".}...l........|
+ssl_decrypt_record found padding 6 final len 105
+checking mac (len 69, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 37 5d 52 b5 a7 ae 5e 90 41 3b ba 07 6b ac 99 c3 |7]R...^.A;..k...|
+| df 2c f1 b2 |.,.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 45960 found (nil)
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #326 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 80 3f 74 e5 3b a0 39 64 10 ea 3c 88 07 0c 79 d5 |.?t.;.9d..<...y.|
+| f1 00 2e 2a 5b 6e 6d 18 d4 b5 e9 85 5c 95 b9 3d |...*[nm.....\..=|
+| 26 23 ec f0 0b 4b 40 ce 5a 31 a9 7c d9 a7 11 6d |&#...K@.Z1.|...m|
+| 14 f7 bd 3a ec ac e7 cd c4 fb 3b 9d 14 2e c4 98 |...:......;.....|
+| 70 4f 4f 87 f4 57 59 79 ec 33 b4 22 6b 36 cf 24 |pOO..WYy.3."k6.$|
+| ad 1e 13 bf 52 38 c3 55 9e ed 34 43 04 c3 d3 4e |....R8.U..4C...N|
+| c1 c9 72 a7 8d 90 31 f2 e1 23 dd 09 16 63 50 b5 |..r...1..#...cP.|
+| fe 73 d3 a8 aa 45 70 7c 1a 5c 09 2d a4 57 47 88 |.s...Ep|.\.-.WG.|
+| a2 97 08 cc 44 5e 7f 8c 41 cb ef 02 33 83 c5 f0 |....D^..A...3...|
+| 10 d3 fb 21 ae 09 15 b7 e4 04 44 b9 40 69 4b 97 |...!......D.@iK.|
+| 34 56 38 5a 9d 9a 0e 0d 72 59 82 21 54 4a 5b 00 |4V8Z....rY.!TJ[.|
+| e9 23 1c 44 c5 8b ed 7b ca 43 af b0 3d 0a 4a 76 |.#.D...{.C..=.Jv|
+| 5c 75 cd 04 c9 8a cc 16 08 da c7 20 44 9b 36 3b |\u......... D.6;|
+| 86 d4 2c 45 07 97 82 b5 f2 bd 8d ec 60 20 5c 88 |..,E........` \.|
+| 79 e7 b5 b0 90 6c fd 6d 59 12 18 ec 06 fa 9e b8 |y....l.mY.......|
+| ac fe 3e 07 45 42 bc f0 71 d8 c7 04 bc 7f 11 fc |..>.EB..q.......|
+| c1 d6 6b fa 1b 80 18 32 87 e4 9a 24 5f 1d 5f 51 |..k....2...$_._Q|
+| 42 8d f7 44 9e 06 1e 2d 3e 64 a4 be 17 05 38 7a |B..D...->d....8z|
+| 35 6c f2 3e 6a a6 82 f8 68 66 e9 95 8d 7d e7 09 |5l.>j...hf...}..|
+| a3 2a 33 3a 57 fa 42 ed b9 c0 f3 d9 c4 26 9d a0 |.*3:W.B......&..|
+| 13 1f de 4e 46 01 f5 f1 7c ac 1f 02 2f 2f d8 4f |...NF...|...//.O|
+| 17 95 56 75 d1 95 0a 01 c3 48 05 2e 3d 11 54 f5 |..Vu.....H..=.T.|
+| 25 58 7b e1 d8 35 a9 93 98 5c 91 a6 da 58 f2 91 |%X{..5...\...X..|
+| 9e f1 d0 e0 bd 76 06 ea e4 e7 66 ab 01 99 af fd |.....v....f.....|
+| ce f5 95 4e ef 40 7a f4 4c bd 39 59 29 a1 1d 7e |...N.@z.L.9Y)..~|
+Plaintext[400]:
+| 39 da 10 18 16 5d da d5 1a 93 51 26 b7 10 25 fa |9....]....Q&..%.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:15 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 34 20 2d 20 43 41 4d 45 4c |x00,0x84 - CAMEL|
+| 4c 49 41 32 35 36 2d 53 48 41 20 20 20 20 20 20 |LIA256-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 4d 20 9d 67 77 69 ef d0 35 d1 eb 1d a1 23 d3 44 |M .gwi..5....#.D|
+| e4 79 3b 4d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.y;M............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6a 8e e9 2a e9 ce 28 ac 0b d3 c7 6a 1d fd ed 93 |j..*..(....j....|
+| b0 10 65 0f |..e. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4463 found 0x33292f0
+
+dissect_ssl enter frame #327 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 2f fa 91 20 7b ba 19 80 01 32 8c 17 e0 75 25 41 |/.. {....2...u%A|
+| 41 0c f5 3c 46 bd c2 f3 56 19 92 48 92 f5 57 66 |A..<F...V..H..Wf|
+| aa 2b e6 a2 d9 dd 5e 02 84 89 97 38 b8 ad 28 63 |.+....^....8..(c|
+Plaintext[48]:
+| b3 b5 9f 91 ae 7f 16 e6 2a 6f fc 4e 60 6e 56 e7 |........*o.N`nV.|
+| 01 00 ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 |.....M....x.....|
+| 33 98 af f5 1a 8e 09 09 09 09 09 09 09 09 09 09 |3...............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ad 9b 1a 4d cf f3 92 91 78 cd ea bc e2 02 33 98 |...M....x.....3.|
+| af f5 1a 8e |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #329 (first time)
+ conversation = 0x7facef999a48, ssl_session = 0x7facc3840530
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 9a ce 46 29 27 09 b2 14 40 0a a7 b5 c3 e4 a6 00 |..F)'...@.......|
+| 9b ef c7 cd c5 1d f9 8b b7 05 7a 29 43 5d 73 56 |..........z)C]sV|
+| 64 a7 1e 82 13 b7 fd 26 4f c1 dc b5 f0 67 10 ef |d......&O....g..|
+Plaintext[48]:
+| 8b 81 b6 5f f3 26 c3 43 a6 52 d5 e0 91 b9 90 ee |..._.&.C.R......|
+| 01 00 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d |..V.....&..&^.i.|
+| a7 69 5f 27 ff 83 09 09 09 09 09 09 09 09 09 09 |.i_'............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 56 96 1b 1c e7 8b 26 a0 89 26 5e ad 69 9d a7 69 |V.....&..&^.i..i|
+| 5f 27 ff 83 |_'.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #334 (first time)
+ssl_session_init: initializing ptr 0x7facc3842ab0 size 688
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 46494 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4464
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #336 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 1135
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0087 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 13 19 85 5e 4c 8c d2 67 a7 29 81 ec 40 c2 6f ee |...^L..g.)..@.o.|
+| b3 69 64 f2 3e b1 c0 bb 7d c3 7f a7 d3 72 1b 14 |.id.>...}....r..|
+| 43 de 90 61 3d 9f e3 23 16 69 0c 36 02 82 3b 5f |C..a=..#.i.6..;_|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+PRF out[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+key expansion[136]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed f0 32 c0 26 48 8f fb b2 07 51 6d b7 |..B..2.&H....Qm.|
+| a0 b4 0e ab bc 15 02 57 89 8a 79 a6 e2 95 79 3a |.......W..y...y:|
+| 0b 06 53 8a 59 5b 25 b3 f2 f6 78 5b d7 2e 1c d6 |..S.Y[%...x[....|
+| cc 85 0c a1 2b e5 ea cf c2 39 41 e4 25 e4 37 33 |....+....9A.%.73|
+| 2c ba fd 95 bc 23 3d 7e 80 e2 b9 ad c1 8e 97 45 |,....#=~.......E|
+| d8 bc ec e9 54 af e6 03 e2 fd 33 7a 84 9e 49 8e |....T.....3z..I.|
+| 81 a2 63 52 d2 f4 c5 96 76 f9 e2 9e cf b5 fa 1b |..cR....v.......|
+| c9 c2 21 7a c6 0d 29 8e |..!z..). |
+Client MAC key[20]:
+| 78 60 59 3f b0 4d 8d 21 dd d6 da b4 eb 8a 48 20 |x`Y?.M.!......H |
+| 95 0c 42 ed |..B. |
+Server MAC key[20]:
+| f0 32 c0 26 48 8f fb b2 07 51 6d b7 a0 b4 0e ab |.2.&H....Qm.....|
+| bc 15 02 57 |...W |
+Client Write key[32]:
+| 89 8a 79 a6 e2 95 79 3a 0b 06 53 8a 59 5b 25 b3 |..y...y:..S.Y[%.|
+| f2 f6 78 5b d7 2e 1c d6 cc 85 0c a1 2b e5 ea cf |..x[........+...|
+Server Write key[32]:
+| c2 39 41 e4 25 e4 37 33 2c ba fd 95 bc 23 3d 7e |.9A.%.73,....#=~|
+| 80 e2 b9 ad c1 8e 97 45 d8 bc ec e9 54 af e6 03 |.......E....T...|
+Client Write IV[16]:
+| e2 fd 33 7a 84 9e 49 8e 81 a2 63 52 d2 f4 c5 96 |..3z..I...cR....|
+Server Write IV[16]:
+| 76 f9 e2 9e cf b5 fa 1b c9 c2 21 7a c6 0d 29 8e |v.........!z..).|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1072
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 332
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 318, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 314 bytes, remaining 1126
+ record: offset = 1126, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1131 length 0 bytes, remaining 1135
+
+dissect_ssl enter frame #338 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51...
+looking for RSA pre-master0080868cbc83906b6ee24c5d9e1ee3ad9985776eaff74dc0...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 d6 e1 06 75 14 7a 53 48 96 db 8c cb ee 52 e8 |$...u.zSH.....R.|
+| ad dd 55 a0 a3 99 3c 62 13 93 66 26 b7 52 34 bf |..U...<b..f&.R4.|
+| 24 28 c1 c4 75 59 4c c2 30 9b ab 49 b8 5e 34 2a |$(..uYL.0..I.^4*|
+| af e5 38 3d 51 a9 74 b4 30 4f d1 45 8b |..8=Q.t.0O.E. |
+hash out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+PRF out[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+key expansion[136]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa |.Q`(UN{..4......|
+| 33 d2 19 11 aa fb 49 ff db 90 40 21 34 51 40 e8 |3.....I...@!4Q@.|
+| 6f 43 d9 f2 a0 70 f5 1c 29 d5 18 c4 8f 5c 3a b5 |oC...p..)....\:.|
+| 8f 00 82 bc 09 23 38 1c 1e 6d e3 3b ca 9f 06 47 |.....#8..m.;...G|
+| a7 d2 76 55 af 1f 77 eb 20 95 5a d8 6e 45 d2 93 |..vU..w. .Z.nE..|
+| 7a 51 47 8d e2 18 7e bf 3f b2 d6 da 35 b8 26 89 |zQG...~.?...5.&.|
+| e6 32 0e 33 5d 7a 1d 7c b5 1e 0b 33 cb 8a 17 3d |.2.3]z.|...3...=|
+| 06 49 69 81 80 13 33 d9 |.Ii...3. |
+Client MAC key[20]:
+| cb 7a ac 73 07 88 12 61 96 dc 45 97 1d 01 00 02 |.z.s...a..E.....|
+| d2 51 60 28 |.Q`( |
+Server MAC key[20]:
+| 55 4e 7b 0f b5 34 a2 eb f6 89 f1 aa 33 d2 19 11 |UN{..4......3...|
+| aa fb 49 ff |..I. |
+Client Write key[32]:
+| db 90 40 21 34 51 40 e8 6f 43 d9 f2 a0 70 f5 1c |..@!4Q@.oC...p..|
+| 29 d5 18 c4 8f 5c 3a b5 8f 00 82 bc 09 23 38 1c |)....\:......#8.|
+Server Write key[32]:
+| 1e 6d e3 3b ca 9f 06 47 a7 d2 76 55 af 1f 77 eb |.m.;...G..vU..w.|
+| 20 95 5a d8 6e 45 d2 93 7a 51 47 8d e2 18 7e bf | .Z.nE..zQG...~.|
+Client Write IV[16]:
+| 3f b2 d6 da 35 b8 26 89 e6 32 0e 33 5d 7a 1d 7c |?...5.&..2.3]z.||
+Server Write IV[16]:
+| b5 1e 0b 33 cb 8a 17 3d 06 49 69 81 80 13 33 d9 |...3...=.Ii...3.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 91 8f ea bd 78 9b 2c b1 e8 ab 4d f4 f3 78 d4 45 |....x.,...M..x.E|
+| e9 9b 56 b0 c6 50 9d 3f f0 73 0c f4 31 99 22 3b |..V..P.?.s..1.";|
+| ad ae 64 7d e5 9e 64 a9 5b f9 f0 5f a3 64 f7 d3 |..d}..d.[.._.d..|
+| 6e ea 93 ca 69 9d 4e 7d cd 63 51 3e 8a 9b c7 b8 |n...i.N}.cQ>....|
+Plaintext[64]:
+| 26 fc 91 f6 e2 86 7d 37 70 47 3b 54 2b 52 3e c7 |&.....}7pG;T+R>.|
+| 14 00 00 0c fa db c0 11 3f c8 41 79 2c 6e 9b 0c |........?.Ay,n..|
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |V.$G............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 12 5c 56 01 93 8c b6 f4 a5 38 cf 2c 92 c0 df 73 |.\V......8.,...s|
+| 56 1f 24 47 |V.$G |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #339 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f5 02 c7 af 76 da 1d 26 df d0 99 08 80 87 c1 c0 |....v..&........|
+| 06 9f aa ea 77 b7 36 6e c8 4c 24 18 f3 32 26 cf |....w.6n.L$..2&.|
+| b1 7e 07 64 ac 97 32 34 48 84 58 77 5e ce bc 44 |.~.d..24H.Xw^..D|
+| a2 5f 0f c5 c4 a2 cd a9 1d a2 f4 f4 70 47 25 0b |._..........pG%.|
+Plaintext[64]:
+| 77 a0 f2 7d 13 86 ff ad 89 da 5e f6 2e e2 21 89 |w..}......^...!.|
+| 14 00 00 0c e4 6f f6 f8 4f f8 97 6f 90 e1 ae d7 |.....o..O..o....|
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |m...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3d 1d 09 bf 7a ae e8 96 39 97 87 3c 82 aa 4c 09 |=...z...9..<..L.|
+| 6d ce 01 fc |m... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #340 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 94 69 cf 52 91 aa 64 9a b7 b4 aa a3 73 88 43 d5 |.i.R..d.....s.C.|
+| a1 e0 de 8a 57 e6 fa 44 f0 84 4d c7 0b 5f 77 b7 |....W..D..M.._w.|
+| cd ab d3 12 f4 5f 83 cd dd 07 4a 19 a2 13 0f 5a |....._....J....Z|
+| 8b 89 b9 ed e4 22 5f 15 82 fb 7f 93 26 a1 cf d6 |....."_.....&...|
+| d6 0e 7d dc f9 cc 52 0f d6 bf 75 ad da 43 62 64 |..}...R...u..Cbd|
+| 35 ab 4b 92 23 9b 39 9b bd 85 67 2a 4c c3 c7 5e |5.K.#.9...g*L..^|
+| c1 12 a3 cd 28 42 a1 5a fd f4 ec 4c 65 c1 1b 6b |....(B.Z...Le..k|
+| 6d 3f cf 83 c2 59 b0 91 b2 86 42 83 3e 14 4e 1e |m?...Y....B.>.N.|
+Plaintext[128]:
+| a2 de e4 4e ac eb 71 32 47 25 4c 54 27 c0 03 c3 |...N..q2G%LT'...|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 63 61 |Host: dhe-dss-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 34 0d 0a 0d 0a 08 02 fe |n.nl:4464.......|
+| fb 08 70 fa 53 4b fb 93 27 16 f1 77 e1 fd 0a 58 |..p.SK..'..w...X|
+| 32 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |2...............|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 9c 2c b5 a9 5c 80 e8 38 4f a1 5a 1a cb 97 6e 3e |.,..\..8O.Z...n>|
+| f5 8e 67 dd |..g. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 46494 found (nil)
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #341 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| d1 55 16 ed 01 dc a3 cc db f7 c0 01 9b 99 7b df |.U............{.|
+| 0b d8 37 20 65 cd c4 32 92 44 2b 35 56 fb fe f8 |..7 e..2.D+5V...|
+| 65 c4 b0 d6 af f9 a8 7f a4 cf 85 4b c3 52 7b cc |e..........K.R{.|
+| e1 7d 9c 34 42 77 bd b4 d6 1f 93 8e a5 0f 44 f5 |.}.4Bw........D.|
+| cf 12 e8 d6 ca 71 0a 33 6b 6f c2 17 e7 d0 4b a0 |.....q.3ko....K.|
+| da 67 86 c0 e0 e5 1e d3 4b ef ce 1a c5 a3 8d 49 |.g......K......I|
+| dc 23 48 f9 a6 71 52 9c 90 39 d4 1a 4c c2 ec 85 |.#H..qR..9..L...|
+| 3d 70 25 36 3a ad 94 b4 8b 49 71 54 15 e1 8b 35 |=p%6:....IqT...5|
+| 30 29 a3 d3 38 45 0f 26 94 f2 44 4f 4e 3c b4 97 |0)..8E.&..DON<..|
+| 11 fc c0 96 6d 1e c1 43 87 27 7d 12 72 83 82 99 |....m..C.'}.r...|
+| cd 1e a8 98 fe dd dc 8d 88 31 13 ba 03 d4 fb 34 |.........1.....4|
+| 89 a3 bb ae b9 50 88 83 33 97 60 f6 be b6 09 6c |.....P..3.`....l|
+| 1a cd 72 8c 16 13 b6 3b 25 76 f6 e6 a0 b0 a2 01 |..r....;%v......|
+| 13 02 e9 52 16 55 fd cd a6 7d a1 3b da 07 3d b4 |...R.U...}.;..=.|
+| 80 4a f1 7f f1 6c 87 01 16 2a 13 d6 17 b5 4e fd |.J...l...*....N.|
+| 0c 8d 1c 48 d0 a5 dd ca 88 4e 0b 71 a9 64 fa b2 |...H.....N.q.d..|
+| 72 c6 04 e6 a6 45 21 5f f0 e9 b3 b2 8e 2a 97 01 |r....E!_.....*..|
+| 26 d7 db d0 cb 5e e8 ad 10 67 bc ab 34 aa 22 d1 |&....^...g..4.".|
+| fc 15 a4 69 aa e5 16 60 66 64 b7 2a ba ed 22 32 |...i...`fd.*.."2|
+| ee ce 25 67 59 51 01 ca c0 fe 83 45 e0 13 30 d1 |..%gYQ.....E..0.|
+| 03 2c 70 83 6c 78 dc 05 3f 9a 24 db fa 5a 79 93 |.,p.lx..?.$..Zy.|
+| ad 24 37 79 03 b5 0a 7c 9d 70 0e 27 4f c6 df 49 |.$7y...|.p.'O..I|
+| 75 48 17 1b d4 f9 c4 ee f6 0e 25 5b 3c 3c ee 24 |uH........%[<<.$|
+| e0 db 23 6b d1 6f f3 70 fa b9 e4 6a bb b5 19 be |..#k.o.p...j....|
+| 82 2a b9 1c 42 59 6d b3 34 0f b1 3e ce fa f3 3c |.*..BYm.4..>...<|
+Plaintext[400]:
+| 56 d8 90 48 74 3a cb a2 26 96 76 52 d3 2a d7 62 |V..Ht:..&.vR.*.b|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 37 20 2d 20 44 48 45 2d 44 |x00,0x87 - DHE-D|
+| 53 53 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SS-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| 9d 2f 0f ef c7 0f ce 43 a6 ee 38 8b 89 9c c5 fc |./.....C..8.....|
+| e0 9c e3 d2 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8c ef 7b 0c b7 61 63 78 62 4a 31 d9 d5 9c f5 fe |..{..acxbJ1.....|
+| 8c 51 93 86 |.Q.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4464 found 0x3329380
+
+dissect_ssl enter frame #342 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 73 c0 6a d0 83 12 3f 6c 73 dd 27 97 76 e3 58 11 |s.j...?ls.'.v.X.|
+| f5 5d 87 8d 64 29 4d c5 83 93 55 43 2c 8b 72 fa |.]..d)M...UC,.r.|
+| c4 da 78 2c 9b a1 ee d5 8d 38 da d6 27 ce ee 88 |..x,.....8..'...|
+Plaintext[48]:
+| 39 d2 ca 89 a0 d7 8f db 1c ab 32 e6 34 ad 7f 5d |9.........2.4..]|
+| 01 00 bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 |......>.X..^....|
+| f4 fe aa 02 19 7f 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bf bc c2 c8 3e 11 58 ad ac 5e e4 f9 1b f9 f4 fe |....>.X..^......|
+| aa 02 19 7f |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #344 (first time)
+ conversation = 0x7facef999cf0, ssl_session = 0x7facc3842ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c2 9c 16 b7 51 d3 f3 82 ab 81 37 5d 14 01 60 7a |....Q.....7]..`z|
+| d6 c0 f6 e8 3c 17 5d 4a 61 ab 32 2e 11 19 49 00 |....<.]Ja.2...I.|
+| dd 61 dc 76 38 55 06 ae 41 9e de f4 74 70 f3 4e |.a.v8U..A...tp.N|
+Plaintext[48]:
+| 4b b8 f2 c8 d7 66 d7 59 07 9f 04 af 0d 1f 56 16 |K....f.Y......V.|
+| 01 00 f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be |....Iv!...{F....|
+| db be 97 91 fc 8d 09 09 09 09 09 09 09 09 09 09 |................|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f9 1e 49 76 21 97 f4 ed 7b 46 a2 d6 8a be db be |..Iv!...{F......|
+| 97 91 fc 8d |.... |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #349 (first time)
+ssl_session_init: initializing ptr 0x7facc3844ff0 size 688
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 56836 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4465
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #351 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0088 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 83 01 a8 73 6c 89 9c 81 75 4b 4d ea a7 a0 82 16 |...sl...uKM.....|
+| d3 ff 0b 5a d2 b9 9e 89 bc 36 9d 5d d1 f5 2c 1f |...Z.....6.]..,.|
+| 81 d9 b8 c7 d2 fe ee eb 0f c8 3a 28 2b 8d 4e cd |..........:(+.N.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+PRF out[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+key expansion[136]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b f1 10 84 e3 4b 5b 18 1a c2 93 19 dd |../;....K[......|
+| 25 ae e3 68 bf 0f e0 03 c5 69 45 6d da 9d 43 ef |%..h.....iEm..C.|
+| 3d e5 25 ac 87 ec 10 ca d6 58 dd 57 6a 3e 8b 0c |=.%......X.Wj>..|
+| 1e 44 44 27 68 0e 21 e1 2a 47 27 f8 df 6b 86 b7 |.DD'h.!.*G'..k..|
+| 80 cd 51 e2 cb 52 2f 43 86 61 e4 42 d7 72 2b 05 |..Q..R/C.a.B.r+.|
+| 55 89 70 37 79 dc d0 8b 88 d8 45 5a 2c d1 f4 d2 |U.p7y.....EZ,...|
+| db 96 a2 be af d9 c4 1c 35 9c 36 26 b3 31 72 fb |........5.6&.1r.|
+| 4c 16 bc 06 78 d2 25 bc |L...x.%. |
+Client MAC key[20]:
+| 68 74 bb f4 d5 e9 18 3e 78 d7 eb 4f c3 05 9a e9 |ht.....>x..O....|
+| 9b 8f 2f 3b |../; |
+Server MAC key[20]:
+| f1 10 84 e3 4b 5b 18 1a c2 93 19 dd 25 ae e3 68 |....K[......%..h|
+| bf 0f e0 03 |.... |
+Client Write key[32]:
+| c5 69 45 6d da 9d 43 ef 3d e5 25 ac 87 ec 10 ca |.iEm..C.=.%.....|
+| d6 58 dd 57 6a 3e 8b 0c 1e 44 44 27 68 0e 21 e1 |.X.Wj>...DD'h.!.|
+Server Write key[32]:
+| 2a 47 27 f8 df 6b 86 b7 80 cd 51 e2 cb 52 2f 43 |*G'..k....Q..R/C|
+| 86 61 e4 42 d7 72 2b 05 55 89 70 37 79 dc d0 8b |.a.B.r+.U.p7y...|
+Client Write IV[16]:
+| 88 d8 45 5a 2c d1 f4 d2 db 96 a2 be af d9 c4 1c |..EZ,...........|
+Server Write IV[16]:
+| 35 9c 36 26 b3 31 72 fb 4c 16 bc 06 78 d2 25 bc |5.6&.1r.L...x.%.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1353
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 541
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 527, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 880 length 523 bytes, remaining 1407
+ record: offset = 1407, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1412 length 0 bytes, remaining 1416
+
+dissect_ssl enter frame #353 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9...
+looking for RSA pre-master008078d26263650f6ddf092133c693e2b2727a3db5f9f9d5...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 9c 46 3d 31 a5 4b 42 7e 81 1b 6c 74 b9 c8 25 |$.F=1.KB~..lt..%|
+| b7 dd e5 6a 5f a7 e4 fc 59 19 b0 ab 79 52 34 bf |...j_...Y...yR4.|
+| 24 49 f7 4f 35 22 63 ff 70 ed e3 65 09 26 f9 da |$I.O5"c.p..e.&..|
+| 77 96 a9 f1 f9 cc 97 c3 be 6a 1f fd fe |w........j... |
+hash out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+PRF out[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+key expansion[136]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 |7.bE.^.......}.X|
+| 1c 90 8c 96 aa d3 e4 c1 c4 83 81 78 13 b0 fe db |...........x....|
+| 15 f3 3b dc a7 da 98 12 2f 97 75 23 1c 00 f4 28 |..;...../.u#...(|
+| 5e c2 2e 5c 1b c4 c7 60 e1 9b b8 54 4b 25 6f 06 |^..\...`...TK%o.|
+| 3c 22 f3 3b c3 fc 2d a1 88 13 85 f6 39 53 5c c1 |<".;..-.....9S\.|
+| 15 b8 90 a4 7a 16 4c 18 94 f4 1b 79 a4 09 5a 61 |....z.L....y..Za|
+| 01 11 50 8c ca 6d df a4 4a 3c 2a 9a 34 cb 52 07 |..P..m..J<*.4.R.|
+| 6b ad bc c7 6e 26 de 14 |k...n&.. |
+Client MAC key[20]:
+| 96 99 e5 44 a6 39 6a 9e 50 4f 9e 44 65 98 29 1a |...D.9j.PO.De.).|
+| 37 ce 62 45 |7.bE |
+Server MAC key[20]:
+| c9 5e e8 a0 94 db c0 ff 86 7d 1c 58 1c 90 8c 96 |.^.......}.X....|
+| aa d3 e4 c1 |.... |
+Client Write key[32]:
+| c4 83 81 78 13 b0 fe db 15 f3 3b dc a7 da 98 12 |...x......;.....|
+| 2f 97 75 23 1c 00 f4 28 5e c2 2e 5c 1b c4 c7 60 |/.u#...(^..\...`|
+Server Write key[32]:
+| e1 9b b8 54 4b 25 6f 06 3c 22 f3 3b c3 fc 2d a1 |...TK%o.<".;..-.|
+| 88 13 85 f6 39 53 5c c1 15 b8 90 a4 7a 16 4c 18 |....9S\.....z.L.|
+Client Write IV[16]:
+| 94 f4 1b 79 a4 09 5a 61 01 11 50 8c ca 6d df a4 |...y..Za..P..m..|
+Server Write IV[16]:
+| 4a 3c 2a 9a 34 cb 52 07 6b ad bc c7 6e 26 de 14 |J<*.4.R.k...n&..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: CAMELLIA256
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| fa 68 d8 87 92 30 22 84 16 34 84 dd 38 e6 1d 34 |.h...0"..4..8..4|
+| 14 ab 5e 86 34 b8 f3 df 6c 43 05 bb 31 1c 09 a8 |..^.4...lC..1...|
+| 56 8a 1a 21 88 32 ef 18 e1 b7 53 c4 31 95 69 ea |V..!.2....S.1.i.|
+| da b8 42 cc d6 1b ec 7a eb 86 c5 3a 0f 2b 58 69 |..B....z...:.+Xi|
+Plaintext[64]:
+| 4b b8 fa 75 08 4a 3f a9 c8 db 63 5d 13 5a 69 5d |K..u.J?...c].Zi]|
+| 14 00 00 0c ae e2 6a 45 89 9e 66 35 23 cf 96 21 |......jE..f5#..!|
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.&1J............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| bc 6b 69 50 7e 25 31 e2 11 b5 10 3b c4 4b 2b 90 |.kiP~%1....;.K+.|
+| 1e 26 31 4a |.&1J |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #354 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| 40 79 2f 88 65 aa f4 a1 4f dd 22 db f8 2b 5d f0 |@y/.e...O."..+].|
+| 9c 00 d4 0c e8 14 b1 79 9f a7 35 64 96 a0 a6 74 |.......y..5d...t|
+| 14 3d f5 b1 2d 07 79 9e bd ac b1 c4 fc 31 ce b9 |.=..-.y......1..|
+| 57 91 ad 39 f0 8e c6 82 25 39 1e d4 3c 28 11 4c |W..9....%9..<(.L|
+Plaintext[64]:
+| f9 8c 08 20 64 18 84 fb cf b0 01 9f 18 29 aa 5c |... d........).\|
+| 14 00 00 0c e0 07 f0 70 10 cf 3e af 77 24 da 12 |.......p..>.w$..|
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |................|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 2b 66 b3 99 42 62 ec 86 a9 57 76 86 10 33 c0 c9 |+f..Bb...Wv..3..|
+| bd 87 0e 8d |.... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #355 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 133
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 128, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 128
+Ciphertext[128]:
+| 55 f0 1a 31 5e cb a0 5b 0f 9f e1 bd 94 ce 47 5d |U..1^..[......G]|
+| d9 d2 82 de 4a 62 4c 6b 65 dd 66 cb 40 d5 f7 38 |....JbLke.f.@..8|
+| 2f 6f 54 fa a8 c7 b6 c8 1d 0c 0f 9d 60 67 a6 53 |/oT.........`g.S|
+| c5 f3 f2 de e7 11 04 6f 18 28 b7 b5 da a9 04 e2 |.......o.(......|
+| 16 04 0a 90 7c 37 1e e7 d3 be f6 53 ad 43 c0 53 |....|7.....S.C.S|
+| 1c 1d 73 2d f6 39 6d b5 00 bc 9d 92 0b d7 7b 57 |..s-.9m.......{W|
+| ee 50 fd bc 91 c3 07 56 99 2b 2d 39 74 21 ff 16 |.P.....V.+-9t!..|
+| 4f 74 6b 4b e6 ce 12 ad 23 cf b7 22 22 3e a9 53 |OtkK....#.."">.S|
+Plaintext[128]:
+| 80 b2 67 f2 b3 04 ab 90 ba d6 20 26 56 47 bd ed |..g....... &VG..|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 72 73 61 2d 63 61 |Host: dhe-rsa-ca|
+| 6d 65 6c 6c 69 61 32 35 36 2d 73 68 61 2e 6c 6f |mellia256-sha.lo|
+| 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 |cal.al.lekenstey|
+| 6e 2e 6e 6c 3a 34 34 36 35 0d 0a 0d 0a c5 76 a8 |n.nl:4465.....v.|
+| fc 7c d4 c7 4d 40 29 77 4d d9 68 ab 41 94 9f 1e |.|..M@)wM.h.A...|
+| b8 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e 0e |................|
+ssl_decrypt_record found padding 14 final len 113
+checking mac (len 77, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 07 5a 3d 9b 9c ce c4 b8 21 60 01 ac 95 56 e4 54 |.Z=.....!`...V.T|
+| ea cd 30 7c |..0| |
+ssl_decrypt_record: mac failed
+association_find: TCP port 56836 found (nil)
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #356 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| dd 3e f4 66 f9 61 9d 1d 08 21 c1 62 e5 32 b5 30 |.>.f.a...!.b.2.0|
+| bd 82 65 ba 66 86 cf 43 09 33 8d 02 0c 31 31 d4 |..e.f..C.3...11.|
+| 6e fa c6 2a b8 88 1f ce 0b 74 5c f8 fd 4e 89 22 |n..*.....t\..N."|
+| eb ab f1 3a eb e4 9b 2b 6f 78 c9 99 1c 92 5c 20 |...:...+ox....\ |
+| bb 71 f1 85 11 af df e0 71 a7 9a bd 4f 51 14 74 |.q......q...OQ.t|
+| d8 6e 9c 02 4e e6 ae 77 29 cf c7 08 59 15 2b 76 |.n..N..w)...Y.+v|
+| 2c 62 6c 43 1c 8e e4 c9 17 c0 53 6e 2f 20 d8 a1 |,blC......Sn/ ..|
+| 12 c0 5b 72 40 9d 7b 9e 2f ac 4f 79 2e 2e dd 45 |..[r@.{./.Oy...E|
+| 84 2d 26 b0 c4 3a 4e ca 97 ef 69 bf d8 97 7b ce |.-&..:N...i...{.|
+| e5 a0 25 24 43 7c 2f 47 a0 17 5b 78 8e ca 01 8c |..%$C|/G..[x....|
+| a2 9c fa fa 08 94 33 96 da 3d b9 ae 49 01 6d 30 |......3..=..I.m0|
+| ea 40 1e 4a 9b 89 d5 df a9 0c bd 16 c9 ac ed a5 |.@.J............|
+| ce e8 7f cd 99 21 cf 62 bc e1 c3 23 a8 07 89 b6 |.....!.b...#....|
+| 9d 7e ca c3 ee 0b ef bf 43 2f 7b e1 16 9b aa 77 |.~......C/{....w|
+| ee 30 f3 21 be 4c ca c7 8a 5c 2d c9 80 bd 16 9f |.0.!.L...\-.....|
+| b6 04 60 5f 39 a3 01 76 f6 c1 15 ce 2f 82 a7 15 |..`_9..v..../...|
+| 5e 5b 58 a8 c2 32 a9 33 3d 4a e2 fd 24 ea d2 18 |^[X..2.3=J..$...|
+| de eb 2d 4f a1 90 53 ac 49 86 bd c1 62 01 40 10 |..-O..S.I...b.@.|
+| 12 59 11 18 a5 ba 33 4b cd c2 1b d4 82 8c 06 cf |.Y....3K........|
+| 60 3d c1 5b 11 3a 02 7d f6 94 42 a5 48 c5 d1 97 |`=.[.:.}..B.H...|
+| b8 db 48 8f 3e 98 f2 98 fd 3a 6b e7 dc 8d ac ce |..H.>....:k.....|
+| f2 db b9 ac 88 59 ca be b4 34 37 69 9b 5b 89 08 |.....Y...47i.[..|
+| bb 3c 4b 27 ec 63 80 57 a2 2f 83 e1 9c 39 03 e8 |.<K'.c.W./...9..|
+| b5 2d 75 e2 dd 0c 7a 10 10 e8 57 5f a1 50 34 d7 |.-u...z...W_.P4.|
+| a4 b1 43 29 c6 6d 87 f0 10 9b 92 41 2d 0b f7 1f |..C).m.....A-...|
+Plaintext[400]:
+| e9 a6 ab 78 e3 ee 73 8e ce ba e2 cc c9 31 10 c6 |...x..s......1..|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 35 0d 0a 43 6f 6e 6e 65 63 74 |th: 145..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 38 38 20 2d 20 44 48 45 2d 52 |x00,0x88 - DHE-R|
+| 53 41 2d 43 41 4d 45 4c 4c 49 41 32 35 36 2d 53 |SA-CAMELLIA256-S|
+| 48 41 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 |HA SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 43 61 6d 65 6c 6c 69 61 28 32 35 36 29 20 4d |=Camellia(256) M|
+| 61 63 3d 53 48 41 31 3c 73 63 72 69 70 74 3e 64 |ac=SHA1<script>d|
+| 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 |ocument.domain='|
+| 6c 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 |local.al.lekenst|
+| 65 79 6e 2e 6e 6c 27 3c 2f 73 63 72 69 70 74 3e |eyn.nl'</script>|
+| df dd 36 53 be 4b 2a cf 0a 54 8d 28 4d d0 04 b9 |..6S.K*..T.(M...|
+| 08 a2 a5 5a 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...Z............|
+ssl_decrypt_record found padding 11 final len 388
+checking mac (len 352, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| f0 53 9d 53 d1 18 af 29 fc eb 69 68 7f 79 c0 f6 |.S.S...)..ih.y..|
+| e8 33 66 a2 |.3f. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4465 found 0x3329410
+
+dissect_ssl enter frame #357 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| c8 8e 52 02 bd ce d2 61 53 4d 77 13 e2 40 96 43 |..R....aSMw..@.C|
+| 8f c1 c7 ff 36 8c 11 d7 e4 5a 15 4c e3 5c 55 f1 |....6....Z.L.\U.|
+| e7 f1 01 6a c5 99 be e3 b9 aa 46 83 00 6b 4e f6 |...j......F..kN.|
+Plaintext[48]:
+| 04 e1 12 3e a1 e8 f2 c9 6d 92 92 9a 0b 52 3f f3 |...>....m....R?.|
+| 01 00 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb |..Ae..V.f...,.}.|
+| 17 8e 07 36 0a b1 09 09 09 09 09 09 09 09 09 09 |...6............|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 41 65 c8 9c 56 fd 66 ea 90 83 2c a2 7d bb 17 8e |Ae..V.f...,.}...|
+| 07 36 0a b1 |.6.. |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #359 (first time)
+ conversation = 0x7facef999f98, ssl_session = 0x7facc3844ff0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 51 75 5c 7b 36 f1 13 5d 48 b0 c7 5b 00 41 13 19 |Qu\{6..]H..[.A..|
+| 76 23 60 e7 84 47 b8 75 02 e6 b6 79 8b fd a0 83 |v#`..G.u...y....|
+| e6 b6 b0 79 22 78 99 6a 4a 84 96 dd 39 12 81 93 |...y"x.jJ...9...|
+Plaintext[48]:
+| d3 8f a5 ef 2f 32 a0 8d b2 9a a1 50 91 a7 6f 52 |..../2.....P..oR|
+| 01 00 ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 |......2.~.#-|.I1|
+| 08 18 ea 38 7c 53 09 09 09 09 09 09 09 09 09 09 |...8|S..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| ee 92 da dd 32 b9 7e ae 23 2d 7c e7 49 31 08 18 |....2.~.#-|.I1..|
+| ea 38 7c 53 |.8|S |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #364 (first time)
+ssl_session_init: initializing ptr 0x7facc38474f0 size 688
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 47180 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4470
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #366 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 884
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0096 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 40 a4 74 5a 04 0a 8f 9b bf 71 9c 43 6a 5f 51 66 |@.tZ.....q.Cj_Qf|
+| 83 6e ef 17 d8 37 f1 93 65 33 43 ff 87 52 b8 eb |.n...7..e3C..R..|
+| f2 b7 97 df 1b 7b da 2b c9 b5 99 02 51 ea 99 37 |.....{.+....Q..7|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+PRF out[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+key expansion[104]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 |r..%{.T.]D4..T..|
+| a7 8f 41 03 e9 93 27 bc 9d 6b 12 30 1c 83 09 e4 |..A...'..k.0....|
+| a3 43 66 3e a5 fd 38 bf 93 58 00 eb 36 6c 2c b3 |.Cf>..8..X..6l,.|
+| 9a 74 e3 7f bc b3 0c 1a 6a 2b 62 83 c0 5a 36 de |.t......j+b..Z6.|
+| 50 3b 19 5f 65 0c 6c fa b1 15 af 88 ba 6a d2 66 |P;._e.l......j.f|
+| db 34 79 4e b3 9c 6f d9 |.4yN..o. |
+Client MAC key[20]:
+| a4 34 1e 3c 9c b0 93 c6 b2 35 ce 14 fe 1b d7 ab |.4.<.....5......|
+| 72 9f d8 25 |r..% |
+Server MAC key[20]:
+| 7b 84 54 e3 5d 44 34 c1 d7 54 84 a4 a7 8f 41 03 |{.T.]D4..T....A.|
+| e9 93 27 bc |..'. |
+Client Write key[16]:
+| 9d 6b 12 30 1c 83 09 e4 a3 43 66 3e a5 fd 38 bf |.k.0.....Cf>..8.|
+Server Write key[16]:
+| 93 58 00 eb 36 6c 2c b3 9a 74 e3 7f bc b3 0c 1a |.X..6l,..t......|
+Client Write IV[16]:
+| 6a 2b 62 83 c0 5a 36 de 50 3b 19 5f 65 0c 6c fa |j+b..Z6.P;._e.l.|
+Server Write IV[16]:
+| b1 15 af 88 ba 6a d2 66 db 34 79 4e b3 9c 6f d9 |.....j.f.4yN..o.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 821
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 807, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 803 bytes, remaining 875
+ record: offset = 875, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 880 length 0 bytes, remaining 884
+
+dissect_ssl enter frame #368 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 342
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 262, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 258 bytes, remaining 267
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d9035104154...
+looking for RSA pre-mastera08f474c2a890fc66f808400c49cc26c2804ab7db0a99844...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 56 9e 18 76 22 de ae 8f 15 c0 e2 55 6f 05 75 |$V..v"......Uo.u|
+| cf b7 7d 5a ad 40 1f f9 ab 2a 95 c1 74 52 34 bf |..}Z.@...*..tR4.|
+| 24 3e 01 c2 f6 75 c7 b3 61 12 79 e5 6c 12 83 3d |$>...u..a.y.l..=|
+| 90 35 10 41 54 1b b4 b4 56 db 47 29 36 |.5.AT...V.G)6 |
+hash out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+PRF out[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+key expansion[104]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 |rox..r....!.#,..|
+| fc 56 c8 01 ac 8d d6 c1 bf 4e 2c c4 72 43 70 ea |.V.......N,.rCp.|
+| d0 b9 89 95 51 41 a8 27 68 1b 3b d2 8c 6b 70 73 |....QA.'h.;..kps|
+| e4 01 07 8e 68 8a 9f 09 ea 32 9d fb 23 54 37 bb |....h....2..#T7.|
+| d3 c8 ee db 13 f2 47 b7 3d 5d 77 94 97 f9 15 81 |......G.=]w.....|
+| 05 99 dd 6a 67 6a 9f 05 |...jgj.. |
+Client MAC key[20]:
+| b0 94 d8 af ea ff 9a 2d b4 ce 30 e0 e6 b5 c3 57 |.......-..0....W|
+| 72 6f 78 ef |rox. |
+Server MAC key[20]:
+| c6 72 1e 7f 86 aa 21 84 23 2c 08 f5 fc 56 c8 01 |.r....!.#,...V..|
+| ac 8d d6 c1 |.... |
+Client Write key[16]:
+| bf 4e 2c c4 72 43 70 ea d0 b9 89 95 51 41 a8 27 |.N,.rCp.....QA.'|
+Server Write key[16]:
+| 68 1b 3b d2 8c 6b 70 73 e4 01 07 8e 68 8a 9f 09 |h.;..kps....h...|
+Client Write IV[16]:
+| ea 32 9d fb 23 54 37 bb d3 c8 ee db 13 f2 47 b7 |.2..#T7.......G.|
+Server Write IV[16]:
+| 3d 5d 77 94 97 f9 15 81 05 99 dd 6a 67 6a 9f 05 |=]w........jgj..|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 267, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 273, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cd 79 dc 6f 62 fe 21 70 42 98 f6 48 e3 dd 80 71 |.y.ob.!pB..H...q|
+| f6 3f f8 59 ae 63 9d f0 69 7b 35 0d 8d d0 f0 28 |.?.Y.c..i{5....(|
+| df 91 4b 54 d7 76 fb d8 e7 5c 84 b0 a8 0f 6f af |..KT.v...\....o.|
+| 32 0d 65 32 a3 dd df 69 7d d3 79 c2 9c 2f 42 a5 |2.e2...i}.y../B.|
+Plaintext[64]:
+| 75 c8 e5 2e 3b 86 34 97 78 25 d2 5e 11 76 82 d4 |u...;.4.x%.^.v..|
+| 14 00 00 0c 88 2d 25 c6 b2 df f9 6e 7b a6 86 5d |.....-%....n{..]|
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |~...............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| e9 2f 86 89 ec 27 c0 b7 e5 32 8c e0 65 48 f7 49 |./...'...2..eH.I|
+| 7e ca fe 05 |~... |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #369 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| f1 0a f2 a7 2e cc 2e 26 d7 f4 5c eb fd bc d6 ee |.......&..\.....|
+| b6 5a 36 1f 57 05 a1 72 a3 50 cc 99 df 24 2a 1b |.Z6.W..r.P...$*.|
+| e6 95 35 30 b1 5a 6a f1 84 2d e0 89 e8 95 0a c7 |..50.Zj..-......|
+| 47 08 e8 27 ab 7b 3d 3e a9 80 f9 0a 7d 1c 27 56 |G..'.{=>....}.'V|
+Plaintext[64]:
+| 9d e9 d9 96 dd a2 da 36 b5 13 46 ca 82 cd c3 21 |.......6..F....!|
+| 14 00 00 0c 86 b5 73 c1 67 fb a0 66 d0 7f b5 c5 |......s.g..f....|
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |...N............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 7a 4a 70 c1 f1 10 be 68 84 5b 77 d3 53 93 9a b7 |zJp....h.[w.S...|
+| 8d fd a0 4e |...N |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #370 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| 68 4a b6 73 42 99 a4 45 24 9b eb 56 6e 8d d8 a0 |hJ.sB..E$..Vn...|
+| 27 bc f4 56 84 c5 bc b3 df 25 60 80 3f fb be d4 |'..V.....%`.?...|
+| b7 f4 33 ed 5d 4b e1 06 cb b7 9b cd d8 04 d2 79 |..3.]K.........y|
+| d4 3e 1b c9 cf db 06 96 56 64 aa 35 0e 2a 33 1c |.>......Vd.5.*3.|
+| 81 bb 4a 37 60 b7 47 7f dc 45 c8 ba 7a 59 6e fb |..J7`.G..E..zYn.|
+| e1 1c e0 c3 f9 f0 5d d0 9d f0 a3 17 cb de 05 94 |......].........|
+| 82 94 03 81 26 51 0e 5e 8e 2f 41 00 fd 90 58 88 |....&Q.^./A...X.|
+Plaintext[112]:
+| d6 f4 8d 74 4f a9 b4 d7 46 26 79 2b a1 bb f5 d7 |...tO...F&y+....|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 73 65 65 64 2d 73 68 61 2e 6c |Host: seed-sha.l|
+| 6f 63 61 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 |ocal.al.lekenste|
+| 79 6e 2e 6e 6c 3a 34 34 37 30 0d 0a 0d 0a 03 a3 |yn.nl:4470......|
+| 54 92 72 54 37 8d ad 36 33 26 d3 0e 22 e3 ce c5 |T.rT7..63&.."...|
+| 34 d4 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d 0d |4...............|
+ssl_decrypt_record found padding 13 final len 98
+checking mac (len 62, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 3c 35 f7 17 1d ca 6f e5 3b b6 d6 90 9e cb af f4 |<5....o.;.......|
+| 49 f6 4b 4c |I.KL |
+ssl_decrypt_record: mac failed
+association_find: TCP port 47180 found (nil)
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #371 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| fa d6 df 69 e5 8b 28 37 ec b4 85 9c 85 99 03 cd |...i..(7........|
+| e1 06 72 7e fe 3b 55 39 53 a5 c3 12 53 b7 50 43 |..r~.;U9S...S.PC|
+| 22 39 a5 c5 d9 f5 e4 10 ca 36 e3 23 e9 f0 52 c0 |"9.......6.#..R.|
+| c9 d7 4e 62 a7 41 49 46 a0 87 3f 93 bc 2e d1 6a |..Nb.AIF..?....j|
+| 15 f7 1f 76 54 41 74 89 28 b9 9d f9 7e 50 91 a7 |...vTAt.(...~P..|
+| 65 cc a2 b5 7e d1 0e 2c 54 bf 4b f6 06 bb 78 d7 |e...~..,T.K...x.|
+| d5 4d 82 21 f9 41 3a 6c fa c4 20 4b 55 b1 a5 c5 |.M.!.A:l.. KU...|
+| e0 50 92 f3 e2 03 e4 2b 90 8c 50 f7 b5 ef 1a 16 |.P.....+..P.....|
+| ea c2 7f 2b a2 a0 d8 ae bc 0b 8f 39 c9 9b ad 93 |...+.......9....|
+| 8d ca cf 99 e7 58 a7 98 1c fd a8 e4 ac d1 c0 ac |.....X..........|
+| c8 b4 a6 ea 4d 12 34 9b 1e 73 ed 25 62 df 91 47 |....M.4..s.%b..G|
+| da 5a 4d be 04 b3 d0 e9 d6 8f 2e bf 91 01 59 68 |.ZM...........Yh|
+| e6 9d 96 74 64 a3 84 dd 9d 1b 1d 8e 37 ef b4 8f |...td.......7...|
+| 8d 74 65 45 74 35 6e a0 00 b0 fe d4 48 38 3f 95 |.teEt5n.....H8?.|
+| 2f ad 20 d8 2e 30 79 2f 0f 26 8d 11 a6 35 bf 30 |/. ..0y/.&...5.0|
+| 8b 6a f3 17 bf 50 c6 53 74 44 5e d5 55 4f 64 46 |.j...P.StD^.UOdF|
+| 17 57 ca 1e 2a ad 5f 07 a4 df 91 3d af 66 54 69 |.W..*._....=.fTi|
+| ec e8 a2 e4 1a f1 3a 93 9c 23 3d 07 8b 51 f8 72 |......:..#=..Q.r|
+| 61 56 16 a9 79 87 09 f6 d7 16 a6 bb f3 9d fd e9 |aV..y...........|
+| e1 ad 5c 5f da fb fb 28 b9 da ec b9 cb 94 71 86 |..\_...(......q.|
+| 4f 5f bd d6 6d cd 83 44 55 4e 6f b0 fd eb 57 ed |O_..m..DUNo...W.|
+| df bc 1b fb c2 53 d0 20 0e 2c fc e8 16 e1 e7 c4 |.....S. .,......|
+| ba f0 51 3b 25 94 13 61 b0 de 39 14 ca a9 a4 f3 |..Q;%..a..9.....|
+| 93 44 1f 92 45 56 01 cf 55 c1 0f 94 7e e3 90 aa |.D..EV..U...~...|
+| 8a 1a de 0f 84 ad 4c 6a 50 8c 04 f3 7c ea ec 55 |......LjP...|..U|
+Plaintext[400]:
+| 3c d3 5c f5 f3 f1 a3 70 18 cf 03 31 81 3f 6b 8d |<.\....p...1.?k.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 36 20 2d 20 53 45 45 44 2d |x00,0x96 - SEED-|
+| 53 48 41 20 20 20 20 20 20 20 20 20 20 20 20 20 |SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 52 53 41 20 | SSLv3 Kx=RSA |
+| 20 20 20 20 20 41 75 3d 52 53 41 20 20 45 6e 63 | Au=RSA Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e ff fb 5d c9 |nl'</script>..].|
+| 6b 40 e2 98 6c b4 36 d8 4e f5 dc 4b b6 1c dc c6 |k@..l.6.N..K....|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 17 da a6 c8 e4 c3 71 ee 5d 95 dc 2f 2e 61 92 85 |......q.]../.a..|
+| 88 69 73 be |.is. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4470 found 0x33cdf40
+
+dissect_ssl enter frame #372 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 29 d1 08 9f 3d 50 58 b8 93 19 50 63 17 f3 74 aa |)...=PX...Pc..t.|
+| 66 d0 fb b3 3e b5 82 e6 ab 09 c7 87 60 41 55 d3 |f...>.......`AU.|
+| 65 fc d7 d8 ec ac 55 22 f7 62 85 de 5e f0 41 cf |e.....U".b..^.A.|
+Plaintext[48]:
+| df 60 4b 7a 98 c5 58 04 db a4 d9 da a8 99 7e 22 |.`Kz..X.......~"|
+| 01 00 de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c |....E.T.!..vj...|
+| 6c 8a 69 44 59 48 09 09 09 09 09 09 09 09 09 09 |l.iDYH..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| de e6 45 8c 54 fd 21 99 c9 76 6a ed 91 0c 6c 8a |..E.T.!..vj...l.|
+| 69 44 59 48 |iDYH |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #374 (first time)
+ conversation = 0x7facef99a240, ssl_session = 0x7facc38474f0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| 78 f0 bb 1a 01 43 9e d6 0b 7c 86 c9 8e 7f ab 74 |x....C...|.....t|
+| c2 2e ad 47 19 29 7d e1 65 28 c7 88 4a 79 a5 80 |...G.)}.e(..Jy..|
+| f0 01 ea c4 e7 e5 5e 37 e7 3e 38 06 89 e2 59 56 |......^7.>8...YV|
+Plaintext[48]:
+| 14 9f f6 9d 8b 3b a1 96 25 5e c2 de 2d 63 cd d2 |.....;..%^..-c..|
+| 01 00 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b |..S..K ......>.+|
+| c5 f9 5a f4 da 38 09 09 09 09 09 09 09 09 09 09 |..Z..8..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 53 dc 96 4b 20 96 b5 c6 00 9b e2 3e dd 2b c5 f9 |S..K ......>.+..|
+| 5a f4 da 38 |Z..8 |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #379 (first time)
+ssl_session_init: initializing ptr 0x7facc3849ab0 size 688
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 60473 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4471
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #381 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 1134
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x0099 -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 81 d9 fb 64 10 67 d7 05 13 b4 15 8f 9a e0 50 12 |...d.g........P.|
+| e7 d1 e4 78 7f 6a 21 26 62 fd 92 66 b3 cb 5f 96 |...x.j!&b..f.._.|
+| ba 68 df e0 c3 21 d8 1c 8f 9a 32 92 52 41 39 fa |.h...!....2.RA9.|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+PRF out[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+key expansion[104]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 |...-.H.K..5....x|
+| ad 35 e1 1c db 56 e9 82 70 1c 36 6f 88 ae 80 0d |.5...V..p.6o....|
+| c7 1b a9 4b 1c ae 21 8c 46 ca 70 dd d9 22 f3 1d |...K..!.F.p.."..|
+| 97 bc 64 b2 6a af 24 bb 32 8c b6 9a be 40 fb fd |..d.j.$.2....@..|
+| 89 a4 e7 88 11 eb f4 03 bf b2 c3 a2 08 5b 76 6e |.............[vn|
+| a1 1a 51 b7 c4 e7 21 9e |..Q...!. |
+Client MAC key[20]:
+| cc 5b c2 a5 d4 69 ff 07 7f 74 3c 2d 61 89 38 ac |.[...i...t<-a.8.|
+| be f3 be 2d |...- |
+Server MAC key[20]:
+| 97 48 1d 4b c6 09 35 b6 ea d7 0c 78 ad 35 e1 1c |.H.K..5....x.5..|
+| db 56 e9 82 |.V.. |
+Client Write key[16]:
+| 70 1c 36 6f 88 ae 80 0d c7 1b a9 4b 1c ae 21 8c |p.6o.......K..!.|
+Server Write key[16]:
+| 46 ca 70 dd d9 22 f3 1d 97 bc 64 b2 6a af 24 bb |F.p.."....d.j.$.|
+Client Write IV[16]:
+| 32 8c b6 9a be 40 fb fd 89 a4 e7 88 11 eb f4 03 |2....@..........|
+Server Write IV[16]:
+| bf b2 c3 a2 08 5b 76 6e a1 1a 51 b7 c4 e7 21 9e |.....[vn..Q...!.|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ record: offset = 63, reported_length_remaining = 1071
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 735, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 11 offset 68 length 731 bytes, remaining 803
+ record: offset = 803, reported_length_remaining = 331
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 12 offset 808 length 313 bytes, remaining 1125
+ record: offset = 1125, reported_length_remaining = 9
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 4, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 14 offset 1130 length 0 bytes, remaining 1134
+
+dissect_ssl enter frame #383 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 214
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 134, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 16 offset 5 length 130 bytes, remaining 139
+trying to use SSL keylog in /tmp/snif/tls/all/premaster.txt
+looking for CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f227...
+looking for RSA pre-master0080925605454b9461199474e97c5f8964d84e2a5400fc5d...
+ checking keylog line: CLIENT_RANDOM 5234bf1f39946cbb0bfb609d207f48d65505ece7f9a7a3ab3dae14bd78af3208 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1ffdb780db6146f384584419396cc01fbd66134b3a857346b1b4627b5c 6FD8D0B4A19996053CAC68669539C482A60FCFD32D8914F961DA94EA4773D9C88E25B0974B5CC318A4B3FF4DC7740F67
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f3af589bbb82b3ea5ed30dd0dec147b27ae1a6858a9cea1dca5cebb6a A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f04e55ef50ccceb098bf3659bac1f850e9eda364ebbd9b5c77dab03ac A049FB93A7820F5475AAA1E1A48FB34BEB28A60D3DAAEB974A0CE4B739EB5A8FE05CF84BED987DB3AA4C449D672BB3BC
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f7ded321950187c63a3145353500785daecb867deea38ad6171fa7307 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf1f4ff7898411888423d1f601ae6c177a9ab4898e3c4eed7efe45c439f3 DA85355E4F7BAB4D831DE925F624F59CD92DF03047ED060CC6D918AB1D439C0EB2510B202644F942EB25A24FF549709A
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20a915554363f942764502b6d1aa46fb423ea231f8e10eaa323171adc4 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecc605ca3d3925c8c1166ab23ee556f1a5054a950e5649f3e40d3f05 0EB9E259808E592237EC51B4967B67EF3B18F948C1B40D7F78E37015494C99D95109015C42EE036DD59F0AC45B1679D8
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf204e1c5933ba5a5fa7da10f35903c506a18c2d476134806f54e800c442 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf205ead314d3093790ae2ca55315b5bdeec740932dc2b752f76f294cc73 BB38ED6182AA21DB07D38C723191F05E7E79AFE4523DA1C597E38BD2F7FB661678D42BD7A9D9297C2FB16BBF95BEF4BE
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2072012dfe9cf12bb93646d4ea9290d8383a1948f00e35d8dc65e4c007 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2067b788048402724018182eed9335101f8725309fdf4e9d8e72d50bbf 8E272F89E34D4821C83A6B3097EB80004F60E2EEFEB6EAD038E7079D35A09F92E18BA9913187147D4B72629DDE00D65F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20c79041a17d143cd6357400b5b7ccaf18811dc7ca587e80315dfca68a 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf202e5d51504ac7923f3a67a540ea3866f2863cbb94d46adff28a7fa5b8 6C1FDA515781DF019E94EAF58E7248DCC22C12DC045C575A37EF3A71392D9599A6F617BCC154E73D17F1F691C3EF3DA7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20551b2b343b5888416688fc84d8de2844e7ce19ecc646cab831ddf94b D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf20ecae5e1e08833f0f676ecb983ffcc8c2ed34c136351a6e1614f3bf0c D0179830783D4CDFF61967C0A258332DB68E2FBDC12FEFC3093B0EA23DD39847A940B45843B7E50893E6E7892A2AC6B7
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21f0ba1bd8021a6da9e7c7577fa300a241aea040960ffe8ada41d11924 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21e2e962ea053b395a3450b67374c68b10d974c3eaf238d47526d3a122 9E192B69F9612E657BD0C54B0ABA9CD8DFDCF784881C06B516440C12C6BD4B4518B6EBA8DA1D611BA5BD1AC481C7E239
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21790bdb99cbb2ffd1813cd5b493e9a6511d52d00d8e33ccca5b2456e8 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21bde054e69eac460efe5577100df821f56e28c763f18a081d0a83528f 469AE5B14D01D5CB62EDF72ED798F41C9E6DD95D6699B78B47A7CEA47D54370771B3A0A174668BE4F3E28FC92C5D54D9
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21d7fa17074e94fb73984c4ac9106be553a968e7caacf495fc4cdc7aef 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf21b08dc081332fd1954f8708d97d752645572ed3b005fc6ecafb7d3b84 9357836F16F7A5BF817773AD7AB1B1128176E69AEEB2901A5AE4E8D29DC176CBE6A2EC7523B37A3DDA7A694A52343A66
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2162ebcca4df9dd8a85bef60a5f32ad94750d79312a79e81d0e2831c5b 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2103e05e34065a8f2a18346f0bbaaa8f16f9dfb86239f74f32ee15c225 257316CF74A782525274728FF1D5D1A9025AD8F4D7ECF5432D233D874CDF0D4D0C5BAD7F65F8E9493FA81076C0033902
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22b764928cbafab08ff101c011e0e23ea0d3b456325df1d9ad5be35b36 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d0b604882dddf5cdae5be82fd4a9c6ef53f8d63988236668a364962 613C50084AD0929A681FDF816CF106C243D2E4FCB5E859E153AB4DBEC53554358D1D4EF9BCA0F1E07B1D3C0AD30638FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22f0fc88026cb67e236c6177467accef60aafc47826c7c58874b5fd56a 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2274a6efe0bcd2ba1749ccb8fed7c3f2014f63f5299bd4472e9fdb9d67 5E317B8E7915594BB1FBE9CB20924B99AA7EACC6C643152FDA4C825C0B1EADF39FE4A283C19CD9F1C7C82E6EC1116F1F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf221d36cb96d56b2b19e29b73232dbdea5db33f1cd2b636f6df512b46cd 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf227d0cfcd52de689a694a469228b090668e94f91aeab3adb64a0d9c692 63F4D7A0FF85994204EACA660B3780C6DB3598042213997CC2A88AD917831946476C120169E7D8167FE832B6E0967903
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22d6d5c5a63c2cde9b46133fbd92252a89898b8a097abd69bd4b0d52c3 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22a13bb34ce297d858b813bfb7040c2b8fcc7b08f44e83582b0161ee5b 9F19D238DE2C1CFA56CA362011216E09BE33A4F008E7E586A2BF27ADF78280EBC078D982BC2048649FDE6EA2CEA0EEC5
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf22c3b044e24bfc9ab07c239ffac94a6d107f59e32a0759b68c90e0f1f0 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf226f0014e4aa334044060079492736752e18960f5212f0b101c77930b8 A7592889BFCD53B6495A4FEDB04CA61397F1F8E9318BC0E886872B5CC81E1DE48542CFFAA55923CB6E3A5A6876DF6997
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2317697507cbbb3967cb4f6c4d3fa8999884b653ce71838b0422ee96c0 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c7eefe8863f203a7309837eacdbf2a9ad5d6bb67b901ad096af5f72e 20B7F151AB0AD5949D9BA4384952EE40FD5B0F362371B4595E13D2E2D754DBC945C4A9DEB3CA64DB24884C9E48832B9E
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23c98aee736e46464b7b4f697663d93b194cfd0ff6ef1f5643e80e54c9 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf23f9360dbe3669c6376ad879ccf1c826a9cbeea4e7de7b3619a0940bef 9A2C35223427D92A88D18F6ABC775A3268DE567E9AADF3EC4BABD9A92561009B0B30A1D3EBE3C877441F988DFD110D43
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf234894c7dd68856e2c8b74c88d5d88e3ae0fdee36f9747a3239d3ca10d 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf230c198ab61d09aa16a950bcd62bb0f11ea883580836040bbe22b66ce7 59778A782CFEE999FC9E66CD627CEE93E43D2EC97D28558168E008F0769E5D366D3CDA09B033FA5DDB7EF4C7ACA05DD1
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf237dd6d144fbeea416dc5b5af17280ce44f15fe2cff0c845cadb2146a0 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2367b0df0c442de4e0d567b4e964205856a38325b3ba492feee4b2beed 98F44C2F4FDAD33963DDD55C49FAA075D6896883D77C9D952E541B96D175C5090A3EE851C3D1C2FEB802546B689F08F2
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf238f8b52e271f6a8350d2f2af885d5e6890f54a3c6687b987220c0aa3d 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf236aebc0e235e7d688c30c0a781aa2475a4f3a0a2b1b1f3e4602232df4 1319855E4C8CD267A72981EC40C26FEEB36964F23EB1C0BB7DC37FA7D3721B1443DE90613D9FE32316690C3602823B5F
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2428c1c475594cc2309bab49b85e342aafe5383d51a974b4304fd1458b 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24d6e10675147a534896db8ccbee52e8addd55a0a3993c6213936626b7 8301A8736C899C81754B4DEAA7A08216D3FF0B5AD2B99E89BC369D5DD1F52C1F81D9B8C7D2FEEEEB0FC83A282B8D4ECD
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf249c463d31a54b427e811b6c74b9c825b7dde56a5fa7e4fc5919b0ab79 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2449f74f352263ff70ede3650926f9da7796a9f1f9cc97c3be6a1ffdfe 40A4745A040A8F9BBF719C436A5F5166836EEF17D837F193653343FF8752B8EBF2B797DF1B7BDA2BC9B5990251EA9937
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf243e01c2f675c7b3611279e56c12833d90351041541bb4b456db472936 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf24569e187622deae8f15c0e2556f0575cfb77d5aad401ff9ab2a95c174 81D9FB641067D70513B4158F9AE05012E7D1E4787F6A212662FD9266B3CB5F96BA68DFE0C321D81C8F9A3292524139FA
+ line does not match client random
+ line does not match
+ checking keylog line: CLIENT_RANDOM 5234bf2441170b662187d858375ca1cbfaac13a7e510f2271da5886037b16c16 3E13917FEEC41AB737ACA10F1486ECD4AA3B6F7A91BC40F7F70EE7F57DC3CDD51C0DB70B66F80157B6F05CE3030DAECB
+found master secret in key log
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 73 e6 eb c0 a0 07 3f 11 e5 c1 d4 06 a7 0e be |$s.....?........|
+| c7 a3 f3 f8 61 da b0 03 b2 a2 b4 86 72 52 34 bf |....a.......rR4.|
+| 24 41 17 0b 66 21 87 d8 58 37 5c a1 cb fa ac 13 |$A..f!..X7\.....|
+| a7 e5 10 f2 27 1d a5 88 60 37 b1 6c 16 |....'...`7.l. |
+hash out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+PRF out[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+key expansion[104]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 |..&.....i....i.(|
+| 44 e4 7c 70 3a 85 4f 59 04 15 14 3e 42 6b fd a4 |D.|p:.OY...>Bk..|
+| b4 e9 d4 6e d7 19 06 1f a3 fe 96 1d 1d 6d 8a fa |...n.........m..|
+| 0e d2 6a da 98 44 0e b0 cb 8c a8 48 21 79 92 d1 |..j..D.....H!y..|
+| a7 8b 66 50 43 1c 12 3c 3c 6c b8 08 b4 e7 5c 8a |..fPC..<<l....\.|
+| 52 0e ad 3d 4d c2 44 6a |R..=M.Dj |
+Client MAC key[20]:
+| e4 fa 2a 45 db 5e e6 c9 7d 6c 6d c7 7a a5 31 c3 |..*E.^..}lm.z.1.|
+| b2 e1 26 b3 |..&. |
+Server MAC key[20]:
+| c7 ad 07 f2 69 cc 0e b0 cc 69 09 28 44 e4 7c 70 |....i....i.(D.|p|
+| 3a 85 4f 59 |:.OY |
+Client Write key[16]:
+| 04 15 14 3e 42 6b fd a4 b4 e9 d4 6e d7 19 06 1f |...>Bk.....n....|
+Server Write key[16]:
+| a3 fe 96 1d 1d 6d 8a fa 0e d2 6a da 98 44 0e b0 |.....m....j..D..|
+Client Write IV[16]:
+| cb 8c a8 48 21 79 92 d1 a7 8b 66 50 43 1c 12 3c |...H!y....fPC..<|
+Server Write IV[16]:
+| 3c 6c b8 08 b4 e7 5c 8a 52 0e ad 3d 4d c2 44 6a |<l....\.R..=M.Dj|
+ssl_generate_keyring_material ssl_create_decoder(client)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material ssl_create_decoder(server)
+ssl_create_decoder CIPHER: SEED
+decoder initialized (digest len 20)
+ssl_generate_keyring_material: client seq 0, server seq 0
+ssl_save_session stored session id[0]:
+ssl_save_session stored master secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+dissect_ssl3_handshake session keys successfully generated
+ record: offset = 139, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - FALSE
+ssl_change_cipher CLIENT
+ record: offset = 145, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| ff fa 82 b0 4d 30 fe 55 33 2f 68 3c a2 4f 8b 45 |....M0.U3/h<.O.E|
+| 0c a0 90 8c 9a 8a 1e b7 76 cd 38 c0 a8 e9 a3 0b |........v.8.....|
+| 6d ac 88 95 50 c1 c5 9c c3 69 ef d9 7c bd d3 8e |m...P....i..|...|
+| 91 a3 60 5d 8e fc b6 b6 93 7c db 9a 59 ba f4 06 |..`].....|..Y...|
+Plaintext[64]:
+| fc f0 34 98 a0 90 d3 43 7b 98 e4 5f c5 9f 40 ce |..4....C{.._..@.|
+| 14 00 00 0c 25 8d d0 f4 43 f4 19 c7 70 b6 b4 72 |....%...C...p..r|
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |.<..............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| d1 b9 74 62 19 ae 91 a2 57 dc 42 d0 6e be 44 56 |..tb....W.B.n.DV|
+| 0d 3c f3 1d |.<.. |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #384 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 250
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 170, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 4 offset 5 length 166 bytes, remaining 175
+ record: offset = 175, reported_length_remaining = 75
+dissect_ssl3_record: content_type 20 Change Cipher Spec
+dissect_ssl3_change_cipher_spec
+packet_from_server: is from server - TRUE
+ssl_change_cipher SERVER
+ record: offset = 181, reported_length_remaining = 69
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 64, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 64
+Ciphertext[64]:
+| cc 70 11 57 0b f2 6c b9 05 43 60 3d 36 a3 fc e6 |.p.W..l..C`=6...|
+| a2 1d 20 67 b7 3b fc 53 dc 60 45 82 38 cc 1b 21 |.. g.;.S.`E.8..!|
+| 8d d1 32 83 c8 2a 8b 18 39 1e 04 80 74 81 53 44 |..2..*..9...t.SD|
+| 85 36 24 9f 5f 69 67 77 f5 b1 7c 18 06 c8 fe f8 |.6$._igw..|.....|
+Plaintext[64]:
+| c8 6b 4d 2b 1b 1c 96 d4 fb 98 5a b0 ff 7e 3f 79 |.kM+......Z..~?y|
+| 14 00 00 0c cc 5e 9b 8a 33 ee 1a 9f a2 82 d0 e8 |.....^..3.......|
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b |S.H]............|
+ssl_decrypt_record found padding 11 final len 52
+checking mac (len 16, version 303, ct 22 seq 0)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| c5 f2 8d 8e 39 6a e6 8b 37 c8 73 87 27 b1 85 8b |....9j..7.s.'...|
+| 53 f0 48 5d |S.H] |
+ssl_decrypt_record: mac ok
+dissect_ssl3_handshake iteration 1 type 20 offset 0 length 12 bytes, remaining 16
+
+dissect_ssl enter frame #385 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 117
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 112, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 112
+Ciphertext[112]:
+| c1 81 85 64 bb 14 3a 97 60 53 86 5e c8 9a 0c 0a |...d..:.`S.^....|
+| 68 87 74 3d 5f 3d 0e 66 ea bc c6 00 15 7a 7a c5 |h.t=_=.f.....zz.|
+| ca ae 14 01 92 a3 7e ee 19 a4 b3 55 02 eb 82 23 |......~....U...#|
+| 76 bb 48 c9 02 f0 20 48 72 ba f7 0f af ea d7 a2 |v.H... Hr.......|
+| 7f 3d b3 34 8f be 50 2c 98 15 18 ec 5d ab 65 66 |.=.4..P,....].ef|
+| a3 e7 f2 27 3a 79 6a 32 be 9c cc 64 ea 9d 4f 50 |...':yj2...d..OP|
+| 87 b2 94 80 1f 05 f5 4d 40 33 ac e4 58 34 5b ca |.......M@3..X4[.|
+Plaintext[112]:
+| f4 97 05 81 29 29 0f cc f5 ab 32 b4 73 2d b1 5a |....))....2.s-.Z|
+| 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..|
+| 48 6f 73 74 3a 20 64 68 65 2d 64 73 73 2d 73 65 |Host: dhe-dss-se|
+| 65 64 2d 73 68 61 2e 6c 6f 63 61 6c 2e 61 6c 2e |ed-sha.local.al.|
+| 6c 65 6b 65 6e 73 74 65 79 6e 2e 6e 6c 3a 34 34 |lekensteyn.nl:44|
+| 37 31 0d 0a 0d 0a 0e 3a 04 3b 3b f8 a8 df d4 b4 |71.....:.;;.....|
+| 88 aa d0 77 2a dc ac 4b ac 12 05 05 05 05 05 05 |...w*..K........|
+ssl_decrypt_record found padding 5 final len 106
+checking mac (len 70, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 8d b4 26 3e bf 0e 09 4c 6d a5 46 ed 83 88 23 bd |..&>...Lm.F...#.|
+| 05 43 5f 20 |.C_ |
+ssl_decrypt_record: mac failed
+association_find: TCP port 60473 found (nil)
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #386 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 405
+dissect_ssl3_record: content_type 23 Application Data
+decrypt_ssl3_record: app_data len 400, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 400
+Ciphertext[400]:
+| 75 c6 d3 7c b8 4d 66 cc fd 0e ed 2f 37 3f 64 04 |u..|.Mf..../7?d.|
+| 6f 75 bf 54 5d a0 eb 02 7f 23 75 4f 2c 1c 26 d3 |ou.T]....#uO,.&.|
+| 3c db e8 c2 69 b2 d6 de 21 20 22 6e e2 7e e4 fc |<...i...! "n.~..|
+| f3 1d 5a 8a 59 12 96 42 1d ad e0 87 b8 0e fb 86 |..Z.Y..B........|
+| 3f ff dd b3 98 42 c3 98 27 df 79 b9 d9 bb b5 bb |?....B..'.y.....|
+| 3b d6 cd 23 fc a7 67 a8 cb 76 c0 30 ce bc 3a 8b |;..#..g..v.0..:.|
+| 62 82 0d 72 ef 85 e8 81 9e 30 6d 89 4f c0 b2 d1 |b..r.....0m.O...|
+| 2d ac f2 40 1c 94 87 1d 7b aa 28 d2 f9 dc f2 41 |-..@....{.(....A|
+| 82 7f be b6 84 c3 30 e6 9f 6d 3a c0 bd 7f 72 44 |......0..m:...rD|
+| 31 ef 41 8f 99 9f a0 1e 63 01 d6 55 12 f6 d7 a4 |1.A.....c..U....|
+| aa 25 6d d4 31 fc 23 f8 55 20 6e 8d 0d 16 53 de |.%m.1.#.U n...S.|
+| 96 cb 5d 8b 9f 6e 96 cf ff f1 ad 24 ac f4 06 49 |..]..n.....$...I|
+| b2 c6 86 a0 d6 50 7e e1 3c fb fb ca bc 05 c9 7b |.....P~.<......{|
+| 03 11 de a3 14 ff 96 9d 67 6c 2e 2a 36 95 c3 4c |........gl.*6..L|
+| c2 d7 3b b0 cd 62 b5 6b 3c 51 07 c4 61 ab 75 45 |..;..b.k<Q..a.uE|
+| ff 9e 7c 2f 79 a7 f9 df 15 f7 02 97 31 a4 ad 83 |..|/y.......1...|
+| 3a 7b 5a 2d 9b ec 1f ad 98 12 be 81 57 8e 64 ff |:{Z-........W.d.|
+| 25 15 00 cb d3 01 21 7d ea 9a 29 65 7f 32 fb ea |%.....!}..)e.2..|
+| bd 39 67 4d 3a c7 88 89 81 f6 74 de 81 a0 44 56 |.9gM:.....t...DV|
+| 39 36 cb 39 64 b2 00 1c b4 7a f3 58 b3 f2 6d 55 |96.9d....z.X..mU|
+| 7f 63 4f 79 ba ed f3 d9 b4 20 11 69 2e 8f c4 8b |.cOy..... .i....|
+| e9 09 2f f0 73 2c af 05 10 7d 1e c3 e5 fe fa 65 |../.s,...}.....e|
+| 50 7a ee 76 6f 15 f9 5a ba c8 d4 ee a3 24 a2 7d |Pz.vo..Z.....$.}|
+| cd 1a 37 fe ed 91 6e 83 9d ab 2c 36 8f 5b 8a e1 |..7...n...,6.[..|
+| 52 ec a3 3e 99 c0 82 17 d1 be dc 45 94 49 2c bb |R..>.......E.I,.|
+Plaintext[400]:
+| 7c 8f 27 4e 03 ee 85 93 f7 84 8c 63 b1 ce 76 b9 ||.'N.......c..v.|
+| 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d |HTTP/1.1 200 OK.|
+| 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 |.Server: nginx/1|
+| 2e 34 2e 32 0d 0a 44 61 74 65 3a 20 53 61 74 2c |.4.2..Date: Sat,|
+| 20 31 34 20 53 65 70 20 32 30 31 33 20 31 39 3a | 14 Sep 2013 19:|
+| 35 35 3a 31 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 |55:16 GMT..Conte|
+| 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 |nt-Type: text/ht|
+| 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 |ml..Content-Leng|
+| 74 68 3a 20 31 34 31 0d 0a 43 6f 6e 6e 65 63 74 |th: 141..Connect|
+| 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 45 78 70 69 |ion: close..Expi|
+| 72 65 73 3a 20 54 68 75 2c 20 30 31 20 4a 61 6e |res: Thu, 01 Jan|
+| 20 31 39 37 30 20 30 30 3a 30 30 3a 30 31 20 47 | 1970 00:00:01 G|
+| 4d 54 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f |MT..Cache-Contro|
+| 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a 30 |l: no-cache....0|
+| 78 30 30 2c 30 78 39 39 20 2d 20 44 48 45 2d 44 |x00,0x99 - DHE-D|
+| 53 53 2d 53 45 45 44 2d 53 48 41 20 20 20 20 20 |SS-SEED-SHA |
+| 20 20 20 53 53 4c 76 33 20 4b 78 3d 44 48 20 20 | SSLv3 Kx=DH |
+| 20 20 20 20 20 41 75 3d 44 53 53 20 20 45 6e 63 | Au=DSS Enc|
+| 3d 53 45 45 44 28 31 32 38 29 20 4d 61 63 3d 53 |=SEED(128) Mac=S|
+| 48 41 31 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d |HA1<script>docum|
+| 65 6e 74 2e 64 6f 6d 61 69 6e 3d 27 6c 6f 63 61 |ent.domain='loca|
+| 6c 2e 61 6c 2e 6c 65 6b 65 6e 73 74 65 79 6e 2e |l.al.lekensteyn.|
+| 6e 6c 27 3c 2f 73 63 72 69 70 74 3e d1 4b 51 f6 |nl'</script>.KQ.|
+| c3 46 f0 aa dd 25 f0 d7 8e 38 f6 d5 1c aa 18 fc |.F...%...8......|
+| 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f |................|
+ssl_decrypt_record found padding 15 final len 384
+checking mac (len 348, version 303, ct 23 seq 1)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 94 66 a7 19 1d 91 b9 b4 22 ed ff 59 95 af c0 15 |.f......"..Y....|
+| 86 55 bf a3 |.U.. |
+ssl_decrypt_record: mac failed
+association_find: TCP port 4471 found 0x33cdfd0
+
+dissect_ssl enter frame #387 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d8 68 1f b9 e4 9b 0e 10 d9 e3 a4 30 b4 95 28 96 |.h.........0..(.|
+| 1d 06 0e 7c 68 38 00 b8 8f 16 94 92 3e f8 63 0e |...|h8......>.c.|
+| 2d 27 a7 ff 18 36 bf c4 d6 6b 97 3e 7e 30 89 ab |-'...6...k.>~0..|
+Plaintext[48]:
+| 60 d1 c3 db e5 ef d9 6b 2d 2b 9e e4 93 15 09 66 |`......k-+.....f|
+| 01 00 cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f |.....P...n.E.).O|
+| 65 10 31 4f 32 2d 09 09 09 09 09 09 09 09 09 09 |e.1O2-..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| cf 0c 1d 50 e4 ee be 6e 9d 45 f9 29 a5 4f 65 10 |...P...n.E.).Oe.|
+| 31 4f 32 2d |1O2- |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #389 (first time)
+ conversation = 0x7facef99a4e8, ssl_session = 0x7facc3849ab0
+ record: offset = 0, reported_length_remaining = 53
+dissect_ssl3_record: content_type 21 Alert
+decrypt_ssl3_record: app_data len 48, ssl state 0x3F
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+ssl_decrypt_record ciphertext len 48
+Ciphertext[48]:
+| d6 cc 07 ba ea 03 7d 68 7c f0 7b ce 4a b4 ed 5b |......}h|.{.J..[|
+| bd e7 c5 32 ff 88 d6 b4 6e af ad 92 9d fe ec 41 |...2....n......A|
+| d2 8f 4c de 30 90 7b 28 7a 1b 1d 96 c7 42 e4 c5 |..L.0.{(z....B..|
+Plaintext[48]:
+| 02 bc 99 84 e6 6f 25 d5 5a 8a bb d5 6c 5e f2 d7 |.....o%.Z...l^..|
+| 01 00 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 |..l3:j>..,o..q.E|
+| a2 fd 84 e0 39 58 09 09 09 09 09 09 09 09 09 09 |....9X..........|
+ssl_decrypt_record found padding 9 final len 38
+checking mac (len 2, version 303, ct 21 seq 2)
+tls_check_mac mac type:SHA1 md 2
+Mac[20]:
+| 6c 33 3a 6a 3e d6 b6 2c 6f e7 fe 71 0a 45 a2 fd |l3:j>..,o..q.E..|
+| 84 e0 39 58 |..9X |
+ssl_decrypt_record: mac ok
+
+dissect_ssl enter frame #394 (first time)
+ssl_session_init: initializing ptr 0x7facc384bfb0 size 688
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 322
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 317, ssl state 0x00
+association_find: TCP port 34652 found (nil)
+packet_from_server: is from server - FALSE
+decrypt_ssl3_record: using client decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 1 offset 5 length 313 bytes, remaining 322
+packet_from_server: is from server - FALSE
+ssl_find_private_key server 127.0.0.1:4472
+ssl_find_private_key can't find private key for this server! Try it again with universal port 0
+ssl_find_private_key can't find private key for this server (universal port)! Try it again with universal address 0.0.0.0
+ssl_find_private_key can't find any private key!
+dissect_ssl3_hnd_hello_common found CLIENT RANDOM -> state 0x01
+
+dissect_ssl enter frame #396 (first time)
+ conversation = 0x7facef99a790, ssl_session = 0x7facc384bfb0
+ record: offset = 0, reported_length_remaining = 1416
+dissect_ssl3_record found version 0x0303(TLS 1.2) -> state 0x11
+dissect_ssl3_record: content_type 22 Handshake
+decrypt_ssl3_record: app_data len 58, ssl state 0x11
+packet_from_server: is from server - TRUE
+decrypt_ssl3_record: using server decoder
+decrypt_ssl3_record: no decoder available
+dissect_ssl3_handshake iteration 1 type 2 offset 5 length 54 bytes, remaining 63
+dissect_ssl3_hnd_hello_common found SERVER RANDOM -> state 0x13
+ssl_restore_session master key retrieved
+dissect_ssl3_hnd_srv_hello found CIPHER 0x009A -> state 0x37
+dissect_ssl3_hnd_srv_hello trying to generate keys
+ssl_generate_keyring_material sess key generation
+tls12_prf: tls_hash(hash_alg SHA256 secret_len 48 seed_len 77 )
+tls_hash: hash secret[48]:
+| 3e 13 91 7f ee c4 1a b7 37 ac a1 0f 14 86 ec d4 |>.......7.......|
+| aa 3b 6f 7a 91 bc 40 f7 f7 0e e7 f5 7d c3 cd d5 |.;oz..@.....}...|
+| 1c 0d b7 0b 66 f8 01 57 b6 f0 5c e3 03 0d ae cb |....f..W..\.....|
+tls_hash: hash seed[77]:
+| 6b 65 79 20 65 78 70 61 6e 73 69 6f 6e 52 34 bf |key expansionR4.|
+| 24 2e 0c dc 75 92 75 a7 f8 85 a9 7a 0b 0f 2e 3b |$...u.u....z...;|
+| e0 7d 9a 46 a0 49 b3 16 c0 a0 97 15 17 52 34 bf |.}.F.I.......R4.|
+| 24 d3 13 75 9a 63 89 f1 fd d3 f7 7e 99 8a 4b ea |$..u.c.....~..K.|
+| 35 c7 70 d5 67 3b 32 9f 06 d2 91 3a e5 |5.p.g;2....:. |
+hash out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79 |...1.f. e..R.%.y|
+| b3 d3 55 21 7f f3 55 37 |..U!..U7 |
+PRF out[104]:
+| 2b 1c b2 41 fc 3a 96 02 d5 0a d2 0a 84 32 26 ef |+..A.:.......2&.|
+| 91 9c 58 52 6c 77 bc 52 de 9f 7d 8d 26 19 3e 09 |..XRlw.R..}.&.>.|
+| c3 0e b3 70 e5 46 9c ad 76 59 4a db 1b 2b e4 45 |...p.F..vYJ..+.E|
+| d0 86 fd 28 55 ad d2 ef 8a d6 e1 30 cf 8c 7d 18 |...(U......0..}.|
+| 8e e5 18 af 12 f3 28 0c f1 72 ce a8 76 d8 69 98 |......(..r..v.i.|
+| a8 8e 90 31 a0 66 f8 20 65 f9 fd 52 17 25 05 79